Self-host Passbolt

deployed & timed by usprices checked · Aug 2026

A team password manager built on OpenPGP — every secret is encrypted to each user's own key and shared through folder-level permissions, so the server only ever holds ciphertext. The community edition is free to self-host; SSO, LDAP provisioning, audit logs, and password policies are pro-only.

Key facts

CategoryPassword manager

LicenseAGPL-3.0

StackPHP, CakePHP, MariaDB

Min RAM2048 MB

Dockeryes

Difficulty

Our recommendation

Pick Passbolt when several people need to share credentials and you want access control that is cryptographic rather than a permissions flag — every secret is encrypted to each user's own OpenPGP key, so revoking someone is a real re-encryption, not a database update. It asks for a real box (2 cores, 2 GB of RAM, 20 GB of disk are the documented minimums) and a working mail path. For a personal vault that just needs to autofill on your phone, Vaultwarden is a fraction of the work; if you want folder-level team governance on a plain PHP stack without the key management, TeamPass is simpler.

What you need

Any VPS with at least 2048 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About an afternoon — budget time for troubleshooting

Install

Run these commands on your server:

# Passbolt CE — official compose file, checksum-verified
curl -LO https://download.passbolt.com/ce/docker/docker-compose-ce.yaml
curl -LO https://github.com/passbolt/passbolt_docker/releases/latest/download/docker-compose-ce-SHA512SUM.txt
sha512sum -c docker-compose-ce-SHA512SUM.txt
docker compose -f docker-compose-ce.yaml up -d
# then register the first admin: docker compose exec passbolt ... cake passbolt register_user

vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Passbolt's community edition is genuinely free and uncapped, but it is a deliberately trimmed edition of a commercial product:

non-negotiableThe free edition is feature-gated, and it's gated exactly where a company needs it. SSO, LDAP and Active Directory provisioning, MFA policies and password policies, and the activity log are all pro-only — the AGPL-3.0 community edition gives you vaults, folders, sharing, and permissions and stops there. Check your must-have list against Passbolt's own edition comparison before you deploy, not after.

non-negotiableEmail and an accurate clock are hard dependencies. Invitations, account recovery, and notifications all go out over SMTP, so you own a working mail path before the first user can even be added — and GPG authentication starts failing when the server's clock drifts, so NTP is part of the install, not an optimisation.

non-negotiableEvery user carries a private key. Onboarding, moving to a new laptop, and offboarding all involve key handling that a password-only manager never asks for, and a user who loses both their key and their passphrase loses access to everything shared with them. Write down how your team stores and recovers those keys before you migrate anything real into it.

An alternative to

1Password →

Head-to-head

Password managerAug 2026

Passbolt

Psono

Two team vaults, two very different licences.

Read the verdict →

Password managerAug 2026

Passbolt

Vaultwarden

A personal vault vs. a team credential system.

Read the verdict →

More in Password manager

Password managerBitwarden

The official self-hostable Bitwarden server — full vendor support and enterprise SSO. Heavier than Vaultwarden, but the right pick when you need a supported, on-prem deployment.

C#SQL Server

moderateRead guide →

Password managerKeeWeb

A self-hostable web and desktop client for KeePass kdbx vault files — not a sync server. You host a single-page app behind your own domain and point it at a vault stored on local disk, WebDAV, or a cloud drive, so there is no database and no account system to run.

JavaScript

easyRead guide →

Password managerPsono

An end-to-end encrypted password manager aimed at IT teams, pairing a Django/PostgreSQL server with browser extensions and a built-in admin portal. The community edition has no user cap; SSO, audit logging, and policy enforcement live in the enterprise build.

PythonDjangoPostgreSQL

hardRead guide →

Password managerTeamPass

A shared credential vault built for IT teams rather than individuals, organised as a folder tree with per-folder access rules, per-user encryption keys, and a full audit trail. One of the longest-running projects in this category, and it runs on the boring, familiar PHP plus MariaDB stack.

PHPMariaDB

easyRead guide →

Common questions

Is Passbolt free to self-host?

Yes — the community edition is AGPL-3.0 and free to run on your own server with no user cap. What you give up versus the pro edition is SSO, LDAP/Active Directory provisioning, MFA policies and password policies, and the activity/audit log.

How much RAM does Passbolt need?

Passbolt's own published minimum is 2 GB of RAM alongside 2 CPU cores and 20 GB of disk. That covers both containers in the official compose file — the PHP app and its MariaDB database.

How does Passbolt encrypt passwords?

Every secret is encrypted with OpenPGP to each recipient's public key, so the server stores ciphertext it has no key for. Sharing a password re-encrypts it for the new user's key, which is why revoking access is a real cryptographic operation rather than a permissions flag.

Does Passbolt need HTTPS and an SMTP server?

Both, yes. Invitations, account recovery, and notifications all go out by email, so a working SMTP server is a hard requirement, and the install also expects TLS plus accurate system time via NTP — clock drift breaks GPG authentication.