Passbolt vs Psono

Once you have decided that a single-user vault is not enough — that what you actually need is a password manager several people share, with an admin who decides who sees what — the self-hosted field narrows fast. Passbolt and Psono are the two serious answers in that space, and they are much closer to each other than either is to a personal vault. Both are end-to-end encrypted, both ship their own clients, both are free to self-host with no user cap, and both keep their most enterprise-flavoured features behind a paid edition. The differences that should decide it are the licence you are inheriting, how much server work each one asks of you, and what happens on the day you have to restore from backup.

Two open-core deals, two different licences

Passbolt's community edition is AGPL-3.0. That is strong copyleft with a network clause: if you modify the server and offer it to users over a network, those modifications have to be published. For most self-hosters running stock containers that is a non-event, but if you were planning to fork it, embed it in a product, or wire in proprietary internal glue and expose it to customers, it is the single most important line in this comparison.

Psono's server is Apache-2.0 — permissive, with an explicit patent grant, and no obligation to publish anything you change. If you work somewhere with a policy against AGPL software, or you intend to build on top of the server rather than just run it, that difference alone can settle the choice before you look at a single feature.

Neither licence tells you what the free edition contains, though, and here the two are more alike than different. Passbolt gates SSO, LDAP and Active Directory provisioning, MFA policies and password policies, and the activity log in its pro edition. Psono keeps single sign-on, audit logging, and centrally enforced policies for its enterprise build. In both cases the free edition gives you the vault, the users, the groups, and the sharing — and in both cases "log in with our identity provider" and "show me who read that credential" are the features you will end up paying for. Do not choose one over the other expecting to dodge that; choose on the things the free editions actually differ on.

Encryption and sharing models

Passbolt is built on OpenPGP. Every secret is encrypted to each recipient's own public key, so the server stores ciphertext it holds no key for, and sharing a password re-encrypts it for the new user's key. Revoking access is therefore a cryptographic operation rather than a permissions flag, which is a meaningfully stronger guarantee than "the UI stopped showing it to them." The cost is that PGP keys are now part of your operations: users have a key, keys have to be backed up, and lost keys are a real recovery event.

Psono is end-to-end encrypted too, with the crypto handled client-side, and organises access around vaults, groups, and shares. It also ships a built-in admin portal in the community build, which is where you manage users and their access without dropping to a shell. For an IT team that expects a console, that is a nicer day-one experience than Passbolt's CLI-registered first admin.

Operational weight: this is the real gap

Both are more work than a single-container vault, but they are not equally demanding.

Passbolt installs from an official, checksum-verified compose file that brings up the PHP/CakePHP app and its MariaDB database together, then you register the first admin with a console command. It rates 3 out of 5 here. Its non-obvious requirements are the ones that bite: a working SMTP server is mandatory, because invitations and account recovery travel by email, and system time must be accurate — clock drift breaks GPG authentication.

Psono rates 4 out of 5, and the extra point is earned. Its Python/Django server expects a PostgreSQL database you have already provisioned yourself — the container will not stand one up for you. Before it runs you generate a server keypair, paste those keys into a hand-written settings.yaml, run a migration against your database, and supply a separate config.json for the web client. It is all documented and none of it is hard, but it is an evening rather than a coffee break, and there is more to get wrong.

The backup detail that catches people out

If you run Psono, remember that backing up the database is not enough. Psono's own documentation is explicit that settings.yaml holds secrets needed to decrypt what is stored in the database, so a database-only backup restores to unreadable ciphertext. Two files, both offsite, tested. Passbolt's backup story is more conventional — the MariaDB dump plus your server configuration — but the same warning applies in spirit: whatever key material lives outside the database, back it up separately or your restore will be worthless.

Which to choose

Choose Passbolt if you want the more turnkey install of the two, an SMTP-driven onboarding flow that is normal for business software, and OpenPGP's hard revocation guarantees — and if AGPL is fine for you. It is the easier of the two to stand up and the safer default for a team that just wants a shared vault working this week.

Choose Psono if the permissive Apache-2.0 licence matters, if your team is happier operating a Django app on Postgres than a PHP app on MariaDB, or if you want the admin portal in the free edition. Accept in exchange that you are provisioning your own database, generating keys by hand, and carrying a second critical file in your backup plan.

Both scale past the point where a personal vault stops making sense, and this is where their editions diverge sharply. Passbolt's SSO is strictly pro. Psono's enterprise build licenses itself free for a small number of users, so a team under that ceiling can run single sign-on and audit logging without paying — above it, you are buying. If SSO is a hard requirement today, decide the edition question first: it will pick the product for you.