Passbolt

Passbolt is an open-source password manager built specifically for teams. Where tools like Vaultwarden focus on individual vault management using the Bitwarden protocol, Passbolt is designed from the ground up for credential sharing and collaboration — with an encryption model that makes the architecture itself the security guarantee.

Every secret is encrypted with the recipient’s OpenPGP public key before it leaves the browser. The Passbolt server stores only ciphertext; it cannot read the passwords it holds. Private keys are generated on the user’s device and never transmitted to the server. This means that a compromised server does not expose your credentials, and Passbolt the company cannot decrypt your data even if compelled to.

Sharing is the core workflow. You can share a single credential or an entire folder with a user or group, with read or write permissions. When you share a secret, Passbolt re-encrypts it with the recipient’s public key so only they can decrypt it. Revoking access cryptographically removes their ability to decrypt future versions. For teams managing shared infrastructure, client accounts, or service credentials, this is a meaningfully different model from a shared vault with a single master password.

The Community edition is free with unlimited users and covers the core use cases: password management, folder sharing, browser autofill, mobile apps, MFA, role-based access control, and the open API. The Business plan adds LDAP and Active Directory provisioning, SSO with Microsoft, Google, and OpenID, full activity audit logs, and support. At $4.90 per user per month with a 10-user minimum, it targets organisations with compliance requirements or directory infrastructure.

The API and CLI are first-class. Passbolt is designed to be queried programmatically, which makes it practical for DevOps use: scripts can retrieve credentials at runtime, rotate secrets via the API, and the Ansible lookup plugin allows playbooks to pull secrets directly from Passbolt without hardcoding them in inventory files.

Passbolt: Pros & Cons