Dora NodaEvery platform team has the same guilty secret: the shared credentials live somewhere embarrassing. A 1Password vault shared a little too widely, a Bitwarden organization stretched past what a password manager was designed to be, or — worst of all — a Vault cluster that one person set up, nobody fully understands, and everybody is afraid to unseal. Into that gap walked an unlikely entrant in August 2026: Obidos, a commercial secrets-sharing product sold since 2024, open-sourced on GitHub by Spenego Software and announced with a quiet Show HN.
The verdict in 30 seconds: Obidos is a sharing-first, human-facing secrets web app — AGPL-licensed, self-hosted, deployable as a container — whose entire design centers on one sentence: share this secret with exactly this group. If your team's pain is humans sharing credentials, 2FA codes, and sensitive documents, and Vault feels like hiring a zookeeper to feed one cat, Obidos deserves a trial deploy. If your pain is machines fetching secrets — CI pipelines, Kubernetes workloads, dynamic database credentials — it is not your tool. The comparison table below makes the boundary exact.
What Obidos actually ships
Obidos describes itself as a "web-based self-hosted secure information repository," and the feature list reads like it was written by someone who watched secrets get shared badly inside real companies. The unit of organization is the Container: items (credentials, documents, notes, files) live in containers, and both items and containers carry either a Private or Shareable tag, so keeping something out of shared circulation is the default rather than a configuration achievement.
Sharing is owner-controlled and group-aware. The owner of an artifact sees exactly who can access it, can delegate update permissions or transfer ownership outright, and group membership propagates both ways: add someone to a group and they inherit everything the group can see; remove them and every group-granted access is revoked. Items can carry an expiration date so a shared credential simply stops being visible after its window closes — a small feature that kills an entire category of "we forgot to revoke the contractor's access" incidents.
The artifact model is template-driven. Out of the box you get structured templates for contact info, credit cards, bank details, and 2FA QR codes, plus personal templates, ad-hoc one-off items, free-form notes, and arbitrary file attachments. Two features stand out against the password-manager baseline: a built-in TOTP authenticator (store the 2FA QR code, view rolling codes inside the app) and user-set 2FA QR codes that gate password or passphrase resets.
Enterprise plumbing includes multiple AD/LDAP directories alongside local accounts, SMTP and SMS gateway integration with customizable email templates, an internal notification system, and built-in auditing.
Under the hood it is unfashionable in the best way: a Java application (GWT frontend, Jetty WAR) with cryptography via libsodium through a JNA wrapper — a boring, well-understood primitive rather than a hand-rolled cipher. Deployment is a Docker Compose stack via the Obidos-Docker repo, or a manual Jetty-plus-systemd install. There is a live demo server (login hndemo / hndemo) if you want to click through the admin and user consoles before committing a single container.
The license deserves a precise read. Obidos is dual-licensed under AGPL-3.0 and a commercial license, and the company states the enterprise and open-source versions currently have identical features — the commercial tier buys admin scripts (database backup, upgrades, bulk user import), a cockpit web console, SNMP support, installation, training, and support. For a team self-hosting the AGPL build unmodified for internal use, the practical obligation is making the (already public) source available to your users — low friction, but worth a conscious nod rather than a shrug.
Obidos vs Vault vs Bitwarden: the comparison
Here is the head-to-head that matters for a two-person platform team. The third column covers Bitwarden's self-hosted story (official stack or the lighter Vaultwarden build), and "Vault" here includes OpenBao, the MPL-2.0 community fork — same operational model, different license.
| Dimension | Obidos | Vault / OpenBao | Bitwarden (self-hosted) |
|---|---|---|---|
| Primary user | Humans sharing with humans | Machines fetching at runtime | Humans with personal credentials |
| Sharing granularity | Per-item and per-container, owner-managed groups with join/revoke propagation | Policy paths (HCL), operator-managed | Organizations, collections, per-item sharing |
| Deploy weight | One container stack plus database | Raft consensus, HA sizing, unseal procedure, backup/restore runbook | Full stack (or single-binary Vaultwarden) plus database |
| Machine/API secrets | Not documented — no CLI, SDK, or Kubernetes story in the repo | First-class: dynamic secrets, API/CLI, External Secrets Operator | Secrets Manager product (bws CLI, ESO provider) — separate from the password vault |
| Audit trail | Built-in auditing | Comprehensive audit devices | Event logs and reports |
| TOTP handling | Built-in authenticator; QR codes are native artifacts | TOTP engine exists but is operator-configured | Authenticator keys per login; separate app UX |
| Enterprise auth | Multiple AD/LDAP plus local users | LDAP, OIDC, and many auth methods | LDAP/SSO (paid tiers for some) |
| License (self-host) | AGPL-3.0 or commercial | BSL-1.1 (Vault) / MPL-2.0 (OpenBao) | GPL/AGPL mix; Secrets Manager GPL |
| Commercial history | Sold since 2024, opened Aug 2026 | HashiCorp since 2015 | Bitwarden since 2016 |
Read the rows, not the brands. Obidos wins exactly one column — humans sharing with humans — and it wins it on specificity: expiring items, ownership transfer, Private-by-default tagging, and QR codes as first-class artifacts are the vocabulary of "the finance team needs the auditor's login until Friday," not "the payment service needs a database password with a 60-second TTL." Vault wins every machine-shaped row by design; dynamic secrets and Kubernetes-native injection are things a sharing web app will never grow. Bitwarden sits in the middle for humans but optimizes for personal credential hygiene (autofill, folder organization, family plans), with machine secrets deliberately split into the separate Secrets Manager product.
The honest industry pattern, visible across homelab writeups and enterprise rollouts alike, is layered: a human credential tool for people plus a secrets engine for machines. Obidos does not collapse those layers — it sharpens the human one.
Where Obidos fits — and where it doesn't
Obidos fits the team whose secrets problem is social, not programmatic. Two platform engineers sharing cloud console logins, the on-call rotation's shared 2FA codes, vendor contracts, TLS private keys generated before anyone set up ACME, the Wi-Fi password for the office that somehow became production infrastructure. Against Vault, the pitch is negative space: no Raft quorum to nurse, no unseal ceremony at 3 AM after a restart, no HCL policy review for "let the new hire see the staging passwords." Against a password manager, the pitch is that sharing is the product, not a feature bolted onto a personal vault — ownership, expiry, and group propagation are the whole point.
Obidos does not fit anywhere a machine is the reader. The repository documents no API client, no CLI, no Kubernetes integration, and no dynamic-secret engine. A CI pipeline cannot mint a short-lived credential from Obidos; the External Secrets Operator has no Obidos provider; nothing rotates. If your roadmap says "workloads pull secrets at deploy time," you still need Vault, OpenBao, Bitwarden Secrets Manager, Infisical, or cloud-native secret stores — Obidos would sit next to them holding the human half, never replacing them.
There is a second non-fit worth stating plainly for this audience: a PaaS cannot outsource tenant-secret handling to a sharing web app. Tenant secrets need programmatic issuance, rotation, per-tenant encryption boundaries, and API-driven lifecycle — the exact rows where Obidos is blank. Run it for your team's own shared credentials if you like; your platform's secret store is a separate architectural decision with a separate threat model.
The hardening checklist before you trust it
A secrets tool earns trust row by row. Here is the checklist to close before Obidos holds anything you would miss — each row names what the project gives you and what stays your job.
| Check | What Obidos provides | What you must still build or verify |
|---|---|---|
| Encryption primitives | libsodium via a JNA wrapper — sound choice | Verify the at-rest story end to end: what is encrypted in the database, where the keys live, and what a stolen disk image yields |
| Admin separation | Admin accounts cannot access user-stored artifacts (stated in README) | Confirm the mechanism in code; "cannot" should mean cryptographically cannot, not UI-hides-it cannot |
| Audit log | Built-in auditing | Define retention, tamper-evidence, and where audit records ship (a log only the app can read is a diary, not an audit trail) |
| Backups | Commercial tier ships backup scripts | OSS self-hosters need their own tested database backup-and-restore runbook before day one |
| Transport security | Jetty deployment docs cover self-signed certs | Terminate real TLS in front of it (reverse proxy, ACME) and never expose the demo-style defaults |
| Availability | Single-stack deploy, no quorum to maintain | That simplicity is also the SPOF analysis: one database, one app — size your recovery plan accordingly |
| License posture | AGPL-3.0 with public source | Record the compliance note: network users get a source offer; trivially satisfied, but write it down |
| Update cadence | Commercial vendor behind it since 2024 | Watch the repo for security advisories yourself — a newly opened project has no track record of response time yet |
None of these rows is a veto; most are an afternoon's work for a team that already operates infrastructure. The point is that "self-hosted" transfers exactly this list to you, and a secrets store is the worst place to discover the transfer mid-incident.
Bottom line
Obidos is the rare Show HN that knows what it is not. It is not a Vault competitor — it concedes every machine-shaped workload without a fight. It is not a password-manager competitor either, quite — it concedes personal hygiene and autofill. What it claims is the unglamorous middle: humans on a small team sharing sensitive things with exactly the right humans, with expiry, ownership, and group propagation built in rather than improvised. For a two-person platform team currently choosing between Vault's operational weight and a password manager stretched past its design, that middle is real, and a containerized trial behind your own reverse proxy costs almost nothing to evaluate.
The broader lesson survives even if you never deploy it: secrets tooling sorts by reader, not by vendor. Humans and machines want different stores with different lifecycle verbs, and every team eventually runs one of each. Pick the human one for its sharing UX and the machine one for its API — and be suspicious of any single product that claims both without showing both.
Running your own infrastructure means your secrets, your uptime, and your call on every dependency — which is exactly why we build in the open. Bex.co is the open-source, AI-native Render alternative: push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.
