# pinterest/knox

Knox is a secret management service

Repository: https://github.com/pinterest/knox
Canonical: https://ross.abutalabs.com/products/pinterest-knox
Language: Go
License: Apache-2.0
License Family: permissive
Last push: 2026-07-10T17:52:14+00:00

## Health v2 (maintenance only)
Score: 64/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 91, release rhythm 8, longevity 100
- inputs: {"age_days": 3827, "days_push": 54, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1268, forks 117 (observed 2026-08-28T04:04:11.450072+00:00)

## What it is
Knox is a self-hosted secret management service written in Go that stores, serves, and rotates secrets, keys, and credentials used by other services. It authenticates machines via mTLS and users via GitHub tokens, supports key rotation after compromise, and keeps audit logs of who accessed what.

## Use cases
- store and rotate secrets for my services
- centralized key management with audit logging
- securely distribute api keys and credentials to machines
- rotate tls certificates and signing keys without a code deploy
- self-hosted secret server with machine authentication
- stop committing keys and passwords to git repositories

## When to choose
- You need a self-hosted central secret store with strong machine auth (mTLS) and per-user access tracking
- Key rotation and an audit trail of secret access are requirements for your infrastructure
- You are comfortable running a Go service (or Docker container) and building around an API/CLI workflow
- You want to eliminate secrets scattered across git repos and laptops

## When to avoid
- You want a turnkey solution with dynamic secrets, database credential generation, or a rich web dashboard
- A managed cloud secret manager (AWS/GCP/Azure) or HashiCorp Vault fits your stack better
- Your project is small enough that environment variables or cloud-native options suffice
- You cannot operate the accompanying client tooling for machine access

## Facets
- artifact type: service
- maturity: active
- function: secrets-management, security
- domain: security, self-hosted, developer-tools
- platform: go, self-hosted, cloud
- tags: key-management, secret-rotation, mtls, audit-logging, credential-storage, secret-store, key-rotation, encryption-keys, devops, linux, macos, docker

## Member repositories
- pinterest/knox (main) score 64

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:11.450072+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:03:39.722570+00:00, confidence not recorded.
  - readme: https://github.com/pinterest/knox (fetched 2026-08-28T04:04:11.450072+00:00, sha c4d3a6372f22)
- Data as of 2026-08-30T08:39:29.467469+00:00.