Vaultwarden vs Passbolt

Both of these are self-hosted password managers under the same licence, and both encrypt your secrets on the client so the server only ever holds ciphertext. Everything else about them is aimed at a different reader. Vaultwarden is a single small binary that gives one person — or a household, or a handful of colleagues — a vault reachable from the apps they already use. Passbolt is a team credential system, built from the ground up around who is allowed to see which secret, and it asks for a real server to run on. Pick the wrong one and you will either be fighting ceremony you did not need, or outgrowing a tool that was never meant to arbitrate access between twenty people.

The clients are the first fork in the road

Vaultwarden reimplements the Bitwarden server API in Rust, faithfully enough that every official Bitwarden client connects to it unmodified — browser extension, iOS and Android apps, desktop app, CLI. That is a bigger deal than it sounds. You are not asking anyone to install unfamiliar software; you are handing them an app they may already have and a server URL. If a family member or a non-technical colleague has to be onboarded, this is close to the easiest sell in self-hosting.

Passbolt ships its own ecosystem: its own browser extension, its own mobile and desktop apps. They are not Bitwarden-compatible and they are not meant to be, because Passbolt's model is different underneath. Every secret is encrypted with OpenPGP to each recipient's own public key, so sharing a password is a cryptographic act — the secret is re-encrypted for the new user's key — and revoking access genuinely removes their ability to decrypt it rather than just flipping a permissions flag. That model needs a client that understands it, which is why Passbolt owns its client stack end to end.

What you run, and what it costs you in hardware

Vaultwarden is one container with a data volume. It is designed to run in as little as 256 MB of RAM, which means the cheapest VPS tier you can rent is enough, and it earns the easiest difficulty rating in this catalogue (1 out of 5). The single real requirement is HTTPS in front of it, because WebAuthn and passkeys will not work without TLS.

Passbolt is a PHP/CakePHP application on MariaDB, installed from an official compose file, and its own documented minimum is 2 GB of RAM — eight times Vaultwarden's floor — alongside a couple of CPU cores and real disk. It rates 3 out of 5 to deploy, and the difficulty is not just container count. Invitations, account recovery, and notifications all travel by email, so a working SMTP server is a hard requirement, not an optional extra. The install also wants accurate system time via NTP, because clock drift breaks GPG authentication. None of this is exotic, but it is three or four more things that have to be right before anyone can log in.

Where Passbolt earns its weight

If you only ever needed a personal vault, none of the above would be worth paying for. Passbolt is worth it when the question stops being "where are my passwords" and becomes "who in this company can see the production database credential, and how do I prove I took it away from the contractor who left." Folder and per-secret permissions, sharing that is enforced by cryptography rather than convention, and a credential model designed for rotation are the things Vaultwarden's organisations and collections approximate but do not match.

Be equally clear about what the free edition does not include. Passbolt's community edition is AGPL-3.0 and free to self-host with no user cap, but SSO, LDAP and Active Directory provisioning, MFA policies and password policies, and the activity log are pro-only. That matters, because those are exactly the features a company large enough to want Passbolt's sharing model tends to ask for next. If your requirement list starts with "log in with our identity provider" and "show me an audit trail," the community edition will not get you there. Vaultwarden, for what it is worth, now ships OpenID Connect SSO and organisation event logs in its free server, though not SAML or SCIM.

Which should you self-host?

Pick Vaultwarden if…

• You are self-hosting for yourself, a family, or a small team, and want the lightest server that will do the job.
• You want everyone to keep using the official Bitwarden apps they already know, with nothing new to install and nothing to explain.
• One container on a 256 MB box behind a reverse proxy is your idea of an install, and you want the ongoing maintenance to be close to zero.

Pick Passbolt if…

• Credential sharing is the actual problem — several people, different levels of access, and a need to revoke cleanly when someone leaves.
• You want per-secret and folder-level permissions backed by OpenPGP rather than a flat shared vault.
• You already run mail and have a server with room to spare, and standing up a PHP app with a MariaDB database and an SMTP dependency is routine for you.

Running either on a VPS

The hardware gap is the practical one. Vaultwarden fits on the smallest instance any provider sells and leaves the box free for other things. Passbolt wants a tier or two up on its own, plus somewhere to send mail from. Whichever you pick, terminate TLS in front of it — Vaultwarden needs it for passkeys, and Passbolt's whole invitation and key-exchange flow assumes it — and keep the machine's clock in sync if you are running Passbolt. The step-by-step setup and VPS options are linked below.