Why people self-host Passbolt
Passbolt is built for teams that need shared credentials, roles, auditability, and a more explicit business workflow around passwords. It is strongest when credential sharing must be governed instead of informal.
The tradeoff is a heavier stack and more process than a household vault usually needs. Plan email delivery, user recovery, and backup verification before rollout.
What Passbolt does well
- Built on OpenPGP: each user has a private key and every secret is encrypted separately for each person with access.
- Fine-grained sharing with users and groups, and an activity log of who accessed or changed what.
- Browser extensions, desktop and mobile apps, a command-line client, and an API for automation.
- Security audits by independent firms, with the reports published.
Who Passbolt is for
Passbolt is a self-hosted password manager for teams, designed around sharing credentials inside an organization: server logins, API keys, shared accounts. It fits IT and DevOps teams and agencies. For a family vault it is more process than you need, and Vaultwarden is the easier route.
Deployment notes
Passbolt is listed with support signals for linux, docker. Check the upstream documentation before exposing it to the internet, review authentication defaults, and keep backups outside the primary host.
The Community Edition comes as Docker images and as packages for Debian, Ubuntu, and other distributions. It needs MariaDB or PostgreSQL and working SMTP, since invitations and account recovery depend on email. The server GPG key and the database have to be backed up together. Each user should store their private key and recovery kit somewhere safe, because the server cannot decrypt their passwords for them. SSO and directory sync are part of the paid editions.
Common questions about Passbolt
Is Passbolt free?
The Community Edition is free and open source with no user limit. Paid plans add features such as SSO, LDAP or directory sync, and support.
Passbolt vs Bitwarden for teams?
Passbolt encrypts each shared secret for each user with OpenPGP and gives granular per-item sharing. Bitwarden groups items into collections and has a larger ecosystem of clients. Both can be self-hosted.
Other self-hosted password manager apps
- Padloc: Modern password manager for individuals and small teams.
- Vaultwarden: Unofficial Bitwarden-compatible server that is light on resources.
Compare them side by side in the password manager category.