Passbolt
The team-first password manager built on OpenPGP, with a free self-hosted Community edition.
About
Passbolt is an open-source password manager designed specifically for teams and developers, built on OpenPGP end-to-end encryption instead of the AES vault model. Each user has their own PGP keypair, which makes per-user and per-group sharing permissions auditable in a way symmetric vaults are not. The Community Edition is free and self-hosted with unlimited users, released under AGPL-3.0, with a paid Business tier at $49 per month for 10 users (self-hosted or cloud) adding LDAP/AD provisioning, SSO, MFA policies, TOTP storage, tags, and priority support.
Passbolt is API-first: a REST JSON API lets teams retrieve, store, and share credentials programmatically, and the product targets developers with CLI tooling and integrations into chats, email, browsers, and terminals. The trade-off is that it requires a browser extension to use, and it needs MariaDB plus SMTP to run. A 2026 comparison put the GitHub project at roughly 4,700 stars with its latest release in January 2026, indicating steady active development.
What it can do
- OpenPGP end-to-end encryption with per-user keypairs
- Granular group and user sharing permissions
- Free self-hosted Community Edition with unlimited users (AGPL-3.0)
- REST JSON API for programmatic credential access
- Activity logs and account recovery
- SSO, LDAP/AD provisioning, MFA policies (paid)
- TOTP storage and tags (paid)
- Developer-focused: CLI, integrations, automations
Setup
Deploy with Docker Compose (Passbolt container plus MariaDB and an SMTP relay), complete the browser-extension setup, and invite the team. Or sign up for Passbolt Cloud to skip the infrastructure.
Prerequisites
A Docker host with MariaDB and working SMTP for self-hosting; a supported browser for the extension.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (metrics tier, metrics-v1). Evidence: 2026 comparisons confirm the OpenPGP architecture, the free unlimited-user Community Edition, the $49/month/10-user Business tier, the browser-extension requirement, the MariaDB/SMTP stack, the REST API, and ~4,700 GitHub stars with a January 2026 release. Strengths: OpenPGP per-user keys give genuinely auditable sharing, free self-hosted team edition, developer API. Docked for: (1) smaller community than Bitwarden-family tools, so fewer third-party clients and guides; (2) browser-extension dependency and no mobile-native vault; (3) TOTP, tags, and LDAP gating behind the paid tier. License: AGPL-3.0 (Community Edition); commercial for Pro/Cloud.
★ 4,700 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 7.0/10
- Maintenance · recency, releases, issue load
- 8.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · ~4,700 GitHub stars; latest release January 2026 (2026 comparison)
- · OpenPGP end-to-end encryption with per-user keypairs; free self-hosted Community Edition with unlimited users
- · Business $49/mo (10 users) adds LDAP/AD, SSO, MFA policies, TOTP storage, tags; browser extension required; MariaDB + SMTP stack
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.