Passbolt

Passbolt is an open‑source, team‑focused password manager designed to be self‑hosted and to keep secrets encrypted end‑to‑end using OpenPGP. It stores and shares credentials with fine‑grained access controls, audit logs, browser extensions, native clients and automation APIs to support collaborative workflows in technical teams.

This tool is aimed at DevOps, IT, engineering groups and other organizations that need on‑premises control, data residency, and auditability for shared credentials. If you can operate servers or Kubernetes, Passbolt gives transparency (open source), strong client‑side encryption, and deployment flexibility; if you prefer a turnkey consumer product, the self‑hosting tradeoffs matter.

Use Cases

• Shared team vaults for infrastructure credentials (SSH keys, service accounts, API keys) where least‑privilege sharing and audit trails are required.
• Integrating secrets into CI/CD and automation via CLI and REST API for programmatic retrieval and rotation.
• Organizations with compliance or data residency needs that prefer to keep secrets behind their firewall or in their cloud VPC.
• Teams that require hardware‑backed 2FA (YubiKey) or SSO integration for enterprise authentication workflows.
• Environments where visibility and audit logs about who accessed or changed secrets are important for security operations.

Strengths

• Open source: Community and Pro editions let you audit code, avoid vendor lock‑in, and choose self‑hosting or vendor cloud.
• End‑to‑end encryption (OpenPGP): Client‑side encryption means the server stores ciphertext only; private keys remain with users.
• Team‑oriented sharing: Groups, roles and fine‑grained permissions (read, write, share) make it suitable for collaborative environments.
• Automation support: CLI and REST API enable integration with CI/CD pipelines and scripted secrets rotation.
• Flexible deployment: Install manual, Docker Compose, or Helm/Kubernetes depending on ops maturity.
• Enterprise integrations: SSO, 2FA (YubiKey), audit logs and paid support for organizations needing SLAs.
• Privacy and transparency: European origin, published audits, and public code help with supply‑chain and data‑protection concerns.
• Free Community Edition: Core functionality available without licensing costs for teams able to self‑host.

Limitations

• Browser extension stability: Community reports cite lag, inconsistent autofill, and reliability issues—this affects daily UX for web logins.
• Self‑hosting complexity: Production deployment requires managing TLS, database, mail, backups and upgrades; Kubernetes adds operational overhead.
• Some features are Pro‑only: Advanced integrations and enterprise features may require paid tiers and vendor support.
• Mobile/desktop UX gaps: Native clients have improved but historically lag mature competitors; validate mobile workflows if they are critical.
• Operational responsibilities: Backups, high availability, patching and monitoring are on you when self‑hosting—plan ops resources accordingly.
• Notification and sharing quirks: Email behavior and sharing notifications can be noisy or confusing; may require tuning or user training.

Final Thoughts

Passbolt is a solid option when you need a team‑focused, open‑source secrets manager that you can host and control. Its OpenPGP client‑side encryption and team sharing model are strong fits for technical organizations that value data residency and auditability.

Before adopting, validate three things in a staging environment: browser extension and native client workflows your team relies on, your capacity to operate the service (backups, TLS, monitoring, upgrades), and whether Pro features or vendor support are required. If running and maintaining infrastructure is a burden, consider the vendor cloud offering or a managed alternative; otherwise, Passbolt offers the transparency and control many security‑conscious teams need.

References

• https://www.passbolt.com
• https://www.passbolt.com/about
• https://github.com/passbolt/passbolt
• https://www.passbolt.com/pricing/cloud
• https://github.com/passbolt/passbolt/issues