# square/keywhiz

A system for distributing and managing secrets

Repository: https://github.com/square/keywhiz
Canonical: https://ross.abutalabs.com/products/keywhiz
Homepage: https://square.github.io/keywhiz/
Language: Java
License: Apache-2.0
License Family: permissive
Topics: keywhiz, secret-management, secret-distribution, enterprise-software, manage-secrets, secrets, secrets-management, crypto
Archived: true
Last push: 2023-09-18T18:01:03+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 4179, "days_push": 1080, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2623, forks 213 (observed 2026-08-28T04:07:05.183585+00:00)

## What it is
Keywhiz is a Java-based system for centrally storing, managing, and distributing secrets such as TLS keys, API tokens, and database credentials. Clients retrieve secrets over mutually authenticated TLS and expose them as files in tmpfs, while administrators manage secrets via a CLI and automation APIs.

## Use cases
- distribute api tokens and database credentials to services securely
- manage tls certificates and keys across a server fleet
- replace secrets in config files with a central secret store
- deliver secrets as files to applications via tmpfs
- automate secret retrieval in a service-oriented architecture
- self-host a secrets management server with mTLS client auth

## When to choose
- you need secrets delivered as files on disk/tmpfs to existing applications
- you want mTLS-based client authentication for secret distribution
- you are already invested in the Java/JVM ecosystem and MySQL
- you need a self-hosted alternative compatible with SOA workflows

## When to avoid
- starting a new project - it is deprecated since September 2023
- you want an actively maintained tool - use HashiCorp Vault instead
- you need cloud-native secret management or dynamic secrets
- you cannot operate Java 11 and MySQL infrastructure

## Facets
- artifact type: service
- maturity: abandoned
- function: secrets-management, auth, security, api-framework, cli
- domain: security, backend, self-hosted
- platform: jvm, self-hosted, cli
- tags: secrets-distribution, mtls, deprecated, dropwizard, enterprise, devops, linux

## Member repositories
- square/keywhiz (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:05.183585+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:19:58.609586+00:00, confidence not recorded.
  - readme: https://github.com/square/keywhiz (fetched 2026-08-28T04:07:05.183585+00:00, sha 46d255109d4c)
  - homepage: https://square.github.io/keywhiz/ (fetched 2026-08-29T10:02:54.755663+00:00, sha 92000c162fb6)
- Data as of 2026-08-30T08:39:29.467469+00:00.