Teampass

What Teampass does

Teampass is a web application for storing and sharing credentials inside an organization, maintained by Nils Laumaillé since 2009. Items live in a tree of folders, and access is granted through roles with read, write, no-edit or no-delete rights, with per-user overrides where needed; when rules conflict, the most restrictive one wins. Each user also gets personal folders that nobody else can read, administrators included.

Much of the recent work targets governance: access review campaigns with recorded decisions, compliance reports, tracking of when passwords were rotated, a view of what a departing employee could still know, and data classification labels. Users sign in locally, through LDAP or Active Directory with nested groups, or with OAuth2 single sign-on, with TOTP, Duo, YubiKey or AGSES as second factors. Imports cover Bitwarden, LastPass, 1Password, KeePassXC and CSV, and exports include CSV, PDF and a self-contained encrypted HTML file for offline use. A REST API, one-time view links and Secure Send handle automation and sharing outside the vault.

Security and encryption

According to the README and the encryption documentation, each secret is encrypted with AES-256-GCM under its own 256-bit key. Every user has an RSA key pair, and each user with access holds an RSA-wrapped copy of the item key, so removing an account revokes access cryptographically. The private key is protected by a key derived from the user’s password with PBKDF2-SHA256 at 600,000 iterations. A second copy of each private key exists so that LDAP or OAuth2 users whose password changed outside Teampass can still sign in; since version 3.2.2.7 that copy is also encrypted with an instance key, so a database dump alone cannot open it.

The documentation describes keys held and used by the server application; it does not present the design as end-to-end or zero-knowledge, so the server and its administrator are part of what you trust. No independent audit is documented. Vulnerabilities are published as GitHub Security Advisories with CVE identifiers, and there is a security hardening guide.

Self-hosting Teampass

Teampass needs PHP 8.2 or later with extensions including openssl, mysqli, mbstring, bcmath, gd, curl and gmp (plus ldap for directory sign-in), and MySQL 5.7+ or MariaDB 10.7+. Redis, APCu and OPcache are optional for sessions and performance. The project recommends a bare-metal PHP install for production and also publishes Docker images on Docker Hub and the GitHub Container Registry.

Hosted version

There is none. Teampass is self-hosted only.

Limitations

The server is free, but the official browser extension for Chrome, Edge and Firefox requires a paid, seat-based subscription and must reach the project’s license server. Without it, people copy credentials from the web interface. There are no native desktop or mobile apps. Teams that want the server unable to read their secrets should look at end-to-end encrypted tools instead.

Who it suits

Teampass fits IT departments and managed service providers that want a self-hosted credential store on a common PHP and MySQL stack, with fine-grained folder permissions and audit evidence. If client-side encryption and free browser extensions matter more, compare Passbolt, Bitwarden or Vaultwarden.