Passbolt

What Passbolt does

Passbolt is a password manager for organizations. Instead of personal vaults that can be shared, it starts from shared credentials: passwords and other secrets sit in private or shared folders, access is granted to users or groups with roles, and admins can set password expiry and follow each resource’s activity. People use it mainly through the browser extension for Chrome and other Chromium browsers, Firefox and Edge, which fills logins and generates passwords, and through the iOS and Android apps. A Go command-line tool and an open API cover automation. The desktop app is still a pre-alpha.

Importers accept exports from 1Password, Bitwarden, Dashlane, LastPass, KeePass (KDBX or CSV) and the Chrome and Firefox password stores, which matters when a whole team moves at once.

Security and encryption

Passbolt is built on OpenPGP. Each user gets a key pair at setup, and the private key stays on their device, protected by a passphrase and never sent to the server unencrypted. When a secret is shared, the client encrypts one copy per recipient with that person’s public key and signs it so recipients can check who sent it and that it was not altered. Login uses a challenge protocol, GpgAuth, that proves possession of the key. With the newer v5 resource format, names, URLs and descriptions can also be encrypted if the organization enables it. Multi-factor authentication supports TOTP, YubiKey and Duo.

The README states that Passbolt is audited several times a year and publishes the findings, and the company’s security page describes at least yearly third-party penetration tests and a bug bounty program.

Self-hosting Passbolt

Community Edition is free for unlimited users. Passbolt documents installs with Docker Compose, Kubernetes, packages for Debian, Ubuntu and the main RPM distributions, Raspberry Pi and cloud images. The recommendation is a clean server with 2 cores and 2 GB of RAM, a working SMTP server, NTP for accurate time, and HTTPS through nginx. The packages set up MariaDB by default, and PostgreSQL is supported. Setup creates or imports a server GPG key.

Pro and Enterprise add tags, LDAP and Active Directory provisioning, single sign-on with Microsoft, Google or OpenID Connect, account recovery, an audit log and support. That code lives in the same AGPL repository, but using it requires a subscription.

Hosted version

Passbolt Cloud is operated by Passbolt SA from Luxembourg on Google Cloud databases in Europe, with each customer’s workspace in a separate database. It is a paid service with a short free trial. The README adds that Passbolt collects no telemetry and the self-hosted edition can run air-gapped.

Limitations

The key-pair model puts responsibility on users: if someone loses their private key and recovery kit, their access is gone unless an admin set up account recovery, which is a paid feature, as are SSO and directory sync. Passbolt is also clearly a team tool; individuals and families get more from Bitwarden or a KeePassXC file.

Who it suits

Passbolt fits IT and engineering teams, agencies and public bodies that want a self-hosted, EU-based tool for sharing credentials with clear permissions. The free edition covers many small teams; organizations needing SSO and LDAP should budget for Pro or compare it with Bitwarden and TeamPass.