Passbolt Review (2026): Pricing, Features & Honest Verdict

TLDR

Passbolt is an open-source, end-to-end encrypted password and secrets manager built for IT and DevOps teams. We rate it the best self-hosted option for technical teams that want to own their encryption keys, though the 10-user paid minimum and plugin-heavy setup rule it out for individuals. Best for: IT and DevOps teams. Price: Free Community edition, Business from EUR 4.50/user/mo. Rating: 7.9/10.

What is Passbolt?

Passbolt is a credential manager that lets a team store, share and audit passwords, secrets and private keys from one place. The thing that sets it apart is the encryption model. Every user has their own OpenPGP private key, and credentials are encrypted to that key client-side, so the Passbolt server never holds plaintext. You can run it yourself on Docker, Kubernetes or a Linux package, or let Passbolt host the cloud version for you.

It is built by Passbolt SA, a security company based in Luxembourg, and the project leans hard into the open-source community. The Community edition is licensed under AGPLv3 and is free forever with unlimited users. Passbolt says more than 50,000 organizations use it, including governments, defense agencies and universities, and the company is SOC 2 Type II audited, GDPR compliant and a FIDO Alliance member. We dug into it as a team-first, self-hostable answer to cloud password managers, and that is exactly who it is for.

What Are Passbolt’s Key Features?

User-owned end-to-end encryption

Each Passbolt user generates a private key protected by a passphrase. Credentials are encrypted to the recipient’s public key, so sharing a password actually re-encrypts it for that person. The server stores only ciphertext, which means a server breach does not hand attackers your vault. This is a meaningfully stronger trust model than managers where the provider technically could decrypt your data.

Granular team sharing and folders

Sharing is where Passbolt earns its keep. You can share a single credential or a whole folder with individual users or groups, and set per-resource permissions like read, update or owner. Reviewers consistently call out the per-resource access controls and folder structure as best in class for teams. If your main pain is twenty engineers passing one staging password around in Slack, this fixes it. Groups map cleanly to how real teams are structured, and revoking a leaver’s access is a single action rather than a scramble to rotate every shared secret they ever touched.

API, CLI and CI/CD integration

Passbolt is API-first. There is a real command-line tool and SDKs, so you can pull secrets into CI/CD pipelines, scripts and infrastructure automation rather than copy-pasting from a UI. For DevOps teams this turns Passbolt into a lightweight secrets store, not just a human password vault. It is one of the clearest reasons it sits in the developer tools category.

Self-hosting, 2FA and access control

You control where the data lives. Deploy via Docker, Kubernetes, a VM appliance or native packages, and keep everything on your own infrastructure. Two-factor authentication, role-based access control, password expiry and browser extensions for Chrome, Firefox and others all ship in the free Community edition. SSO, LDAP and Active Directory provisioning are reserved for paid Business plans. Native mobile and desktop apps round out the clients, so a credential added on a laptop is available on a phone moments later.

Audit logging and recovery controls

On Business plans, Passbolt adds activity logging so admins can see who accessed or changed which credential, which matters for compliance and incident response. It also adds account recovery and key escrow, a real consideration with a private-key model where a lost passphrase normally means a lost vault. Tags help larger libraries stay searchable. These are the features that turn a developer tool into something an IT department can defend in an audit.

How Much Does Passbolt Cost?

Passbolt starts at free. The Community edition is open source, self-hosted, with unlimited users and unlimited instances, and it is not a crippled demo. It includes 2FA, browser extensions, the CLI, the API and role-based access control. For a lot of technical teams that is the whole product.

Paid plans unlock the enterprise glue. The Business plan is EUR 4.50 per user per month self-hosted (roughly USD 4.90) billed annually, or EUR 5 per user per month for the Passbolt-hosted cloud version. Both carry a hard minimum of 10 users, with volume discounts past 100 seats. Business adds SSO with Microsoft, Google and OpenID, LDAP and Active Directory provisioning, account recovery, activity logging and next-business-day support. Enterprise is custom quoted and adds high-availability and disaster-recovery consulting, white-glove migration and a 4-hour SLA with phone support.

Against the field that is competitive but not the cheapest. Bitwarden Teams is $4 per user per month and can also be self-hosted, while 1Password Business runs $7.99 per user per month cloud-only. Passbolt’s free self-hosted tier undercuts both for teams willing to run their own server, but the 10-user paid minimum means a 3-person startup that wants SSO pays for 10 seats. That is the catch. For comparison, Vaultwarden, the lightweight Bitwarden-compatible server, is free with no seat minimum at all, which is why budget-conscious small teams often start there before they outgrow it.

Who is Passbolt Best For?

Use Passbolt if you are a technical team that wants to own your encryption keys and host your own credential store. It is a natural fit for DevOps teams, security-conscious engineering orgs, agencies managing client secrets, and regulated environments like governments and universities that cannot put credentials in a third-party cloud. The API and CLI mean it slots into existing automation, so credentials your pipelines need can live in the same vault your humans use. If data residency or key ownership is a hard requirement from your compliance team, Passbolt is one of the few managers that genuinely satisfies it.

Skip Passbolt if you are a solo maker or a small non-technical team. The 10-user minimum on paid plans makes SSO and provisioning expensive for tiny shops, the mandatory browser extension annoys some users, and the private-key onboarding is less hand-holding than a polished consumer app. If nobody on your team wants to run or maintain a server, the self-hosting advantage turns into a liability.

• Great fit: DevOps and IT teams, security-first engineering orgs, agencies, public-sector and education.
• Poor fit: individuals, freelancers, and small non-technical teams under 10 people.

Best Passbolt Alternatives

Bitwarden

Bitwarden is the obvious cross-shop. It is open source, can be self-hosted or used as a polished cloud service, and Teams starts at $4 per user per month with Enterprise at $6. Its clients and onboarding are smoother than Passbolt’s and there is no 10-user minimum on cloud plans. Passbolt wins on per-resource team sharing and its user-owned key model, but Bitwarden is the easier default for most teams.

Vaultwarden

Vaultwarden is an unofficial, lightweight Bitwarden-compatible server written in Rust, and it is completely free. It runs on a tiny VPS, works with the official Bitwarden clients, and is the go-to for individuals and small teams who want self-hosting without Passbolt’s heavier footprint or paid minimums. You give up Passbolt’s granular per-resource ACLs and official support, but the price is unbeatable.

1Password

1Password is the premium cloud-only option, with Business at $7.99 per user per month. It has the most refined apps, broadest integrations and best end-user experience, plus features like Secrets Automation. It does not self-host at all, so it is the wrong pick if data residency or key ownership is your driver. Choose 1Password when polish and zero ops matter more than self-hosting.

Final Verdict: Is Passbolt Worth It?

Passbolt is the strongest self-hosted, key-owned password manager for technical teams, and that focus is its whole identity. The end-to-end encryption with user-owned private keys is a genuinely stronger trust model, the per-resource sharing is best in class for teams, and the free Community edition is a real product rather than a teaser. For DevOps and security-minded engineering orgs, it earns its 7.9 rating. The fact that the free tier is a complete, self-hostable product rather than a trial is rare in this category and worth a lot on its own.

The reasons it is not higher are real. The 10-user paid minimum prices out small teams who want SSO, the mandatory browser extension can be flaky, and support response times draw complaints. If you have the technical chops to self-host and value owning your keys, Passbolt is an easy recommendation, and the free tier costs you nothing to try. If you want a smooth cloud experience for a handful of non-technical people, look at Bitwarden or 1Password instead.