🩺 Vitals
- 🟢 Last active: 2026-08-04
- 📦 Latest release: v5.14.0 (2026-07-28)
- 🐞 Open issues: 28
- 🌟 Stars: 6.1k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: passbolt.com
- Source: github.com/passbolt/passbolt_api
- License: AGPL-3.0
- Deployment: Docker | Kubernetes | SaaS
- Data Model: MariaDB / MySQL (client-side OpenPGP keys)
- Jurisdiction: Luxembourg 🇱🇺 / EU 🇪🇺 (Passbolt SA)
- Compliance (SaaS): SOC 2 Type II
- Compliance (Self-Hosted): GDPR Ready
- Complexity: Moderate (3/5) - Container Stack + Server GPG Key
- Maintenance: Moderate (3/5) - Regular Security Patches
- Enterprise Ready: High (4/5) - SSO, LDAP & Audit Logs (Pro Edition)
1. The Executive Summary
What is it? Passbolt is a self-hostable password manager built for teams that share credentials, not for individuals who store their own. Every secret is encrypted client-side with OpenPGP, so the server holds ciphertext it can never read, and sharing a credential is a key operation rather than a copy. It ships a browser extension, a mobile app, and a CLI, which is why security and DevOps teams reach for it to distribute service accounts, API keys, and infrastructure credentials. The distinguishing fact is corporate: Passbolt SA is domiciled in Luxembourg, placing the vendor and its hosted cloud under EU jurisdiction rather than US.
The Strategic Verdict:
- 🔴 For the Broadest End-User Ecosystem: Caution. If you need a consumer-grade vault with the widest client and integration coverage, Bitwarden is the more complete platform. Passbolt is deliberately team- and sharing-first.
- 🟢 For EU Data Sovereignty: Strong Buy. A Luxembourg entity with an EU-hosted cloud removes the US CLOUD Act exposure that shadows US-domiciled vendors, and OpenPGP client-side encryption means the operator never holds a readable secret. For European public sector and regulated industries, that combination is the whole argument.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | 1Password (SaaS) | Passbolt (Self-Hosted) |
|---|---|---|
| License Fee | ~$8/user/mo | $0 (Community Edition) |
| Infrastructure | $0 (vendor cloud) | ~$20/mo (VPS + MariaDB) |
| Compliance Tooling | Bundled | Pro subscription (SSO, LDAP, audit log) |
The third row is where the "free" self-hosted story gets an asterisk. The Community Edition secures and shares credentials at no cost, but the features an auditor asks for first, Single Sign-On, directory sync, and the immutable activity log, sit behind the paid Pro Edition. Price the Pro seats before you conclude that self-hosting is free.
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Mature Docker images, Helm charts, and VM installers for Debian and Ubuntu. The one step that catches newcomers is the server-side GPG key: Passbolt generates an OpenPGP keypair for the server identity during setup, and that key plus your database is the entirety of what you must back up and protect.
- Scalability: The API is stateless PHP behind a MariaDB or MySQL backend, so it scales horizontally the way any standard web tier does. Because encryption is client-side, the server never becomes a cryptographic bottleneck; the database is the state you plan capacity and backups around.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & The CLOUD Act: Passbolt SA is incorporated in Luxembourg, and its managed cloud is EU-hosted. That is the structural inverse of a US-domiciled vault: there is no US parent that a CLOUD Act order can compel. Combined with OpenPGP client-side encryption, even the hosted offering stores only ciphertext the operator cannot decrypt. For an EU public-sector buyer, this is the sovereignty position that a US product reaches only after you take on the hosting yourself.
- The Compliance Shift: The vendor cloud carries SOC 2 Type II; the self-hosted edition is GDPR Ready but ships you the responsibility. The application produces the audit log and access controls an assessor wants, but only on the Pro Edition, and the infrastructure around it (network perimeter, backup integrity, high availability) becomes your control to evidence. Self-hosting on the Community Edition without the Pro audit log means you hold the secrets but cannot produce the access trail an auditor will ask to see.
- The AGPLv3 License Trap: The codebase is AGPL-3.0. Running it as an internal corporate vault is entirely safe. The network clause only bites if you modify Passbolt and expose the modified version as a service to third parties, at which point you owe those users your source changes. Ordinary internal deployment never triggers it; embedding a forked Passbolt into a customer-facing product does.
4. Market Landscape
🏢 Proprietary Incumbents
- 1Password: The incumbent for team credential sharing, with polished clients and Secrets Automation. The trade is a mandatory vendor cloud under US corporate control.
🤝 Open Source Ecosystem
- Bitwarden: The broader open-source counterpart. Bitwarden (US entity) leads on client ecosystem and end-user coverage; Passbolt counters with EU jurisdiction and an OpenPGP sharing model aimed at security and DevOps teams.
- KeePassXC: The offline complement. Where Passbolt shares team credentials over a server, KeePassXC keeps break-glass and air-gapped secrets in a local file that never syncs.