Passbolt

Key features

• End-to-end OpenPGP encryption Secrets are encrypted for each authorised user, and the private key is never sent to the server in cleartext, keeping server operators and eavesdroppers out of the plaintext.[1]

• Granular per-password access rights Permissions are set at the individual password level across users and groups, with signed operations that cryptographically identify who created each secret.[1]

• Private and shared folders Teams separate personal credentials from shared ones, combining folders with users-and-groups management and role-based access control for exact role-based onboarding.[1]

• Broad self-hosting targets The install guide covers Debian, Ubuntu, RHEL-family, SUSE-family, and Oracle Linux packages, Docker, a Helm chart, Ansible, Raspberry Pi, AWS and DigitalOcean images, and from-source builds.[1]

• Browser extensions, CLI, and open API Everyday use runs through auto-updating browser extensions with a personal anti-phishing security token and challenge-based authentication, while the CLI and JSON API support automation.[1][2]

• SSO, LDAP, and escrow recovery on Pro Paid editions add Microsoft, Google, and OpenID single sign-on, AD and OpenLDAP provisioning, and account recovery, which the free edition does not include.[1]

• Password lifecycle controls Expiry tracking is built into the free edition while tag management and the full activity log arrive with paid plans, keeping shared vaults reviewable instead of decaying into stale secrets.[1]

• Audited, standards-based posture The vendor reports a SOC 2 Type II audit, GDPR compliance, FIDO Alliance membership, and entry into the ANSSI CSPN certification process.[1][2]

Who will love it

• Regulated IT teams Teams that must show where credentials live and who touched them benefit, because self-hosting plus per-password rights and audit logging maps onto that burden inside their own perimeter.[1][2][3]

• Open source-first organisations Organisations wanting AGPL-licensed core software with interoperable OpenPGP crypto, including the option to use their own PGP keys, instead of a proprietary vault format.[1][2]

• Small teams leaving spreadsheets Teams needing free, unlimited-user sharing with folders and groups before justifying per-seat spending, since the Community Edition covers that workflow at no licence cost.[1]

Who should avoid it

• Non-technical households Households wanting a zero-maintenance consumer vault should look elsewhere, because even easy paths assume someone runs a server, and extension-first use feels alien next to built-in phone autofill.[1][2]

• Single users with one device Single users gain nothing from group sharing, escrow, or LDAP and would carry team-tooling overhead for no benefit.[1]

• Teams needing free SSO on day one SSO, directory provisioning, and the audit log sit behind paid Pro with a ten-user minimum, pricing out very small teams that still need directory login.[1]

Fit and portability