Self-host Psono

deployed & timed by usprices checked · Aug 2026

An end-to-end encrypted password manager aimed at IT teams, pairing a Django/PostgreSQL server with browser extensions and a built-in admin portal. The community edition has no user cap; SSO, audit logging, and policy enforcement live in the enterprise build.

Key facts

CategoryPassword manager

LicenseApache-2.0

StackPython, Django, PostgreSQL

Min RAM2560 MB

Dockeryes

Difficulty

Our recommendation

Choose Psono when you want an end-to-end encrypted vault for an IT team with its own admin portal, groups, and API keys, and you don't care about Bitwarden client compatibility. It is the most assembly-required option in this category — external Postgres, generated server keys, a hand-written config — so pick it for the admin portal and the API, not for a quiet evening. If you mainly want a personal or small-group vault, Vaultwarden does that in one container; if team sharing is the point, Passbolt's per-user key model is the more rigorous design.

What you need

Any VPS with at least 2560 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About the better part of a day

Install

Run these commands on your server:

# Psono CE — Postgres, then the combo image (server + web client + portal)
docker run -d --name psono-db --restart=unless-stopped \
  -e POSTGRES_DB=psono -e POSTGRES_USER=psono -e POSTGRES_PASSWORD=CHANGEME \
  -v psono-db:/var/lib/postgresql/data postgres:16
sudo mkdir -p /opt/docker/psono /opt/docker/psono-client
docker run --rm psono/psono-combo:latest python3 ./psono/generateserverkeys.py
# copy the printed keys into /opt/docker/psono/settings.yaml (see the CE install doc
# for the template) and create psono-client/config.json before the next step
docker run --rm -v /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml \
  psono/psono-combo:latest python3 ./psono/manage.py migrate
docker run --name psono-combo --sysctl net.core.somaxconn=65535 -d --restart=unless-stopped \
  -v /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml \
  -v /opt/docker/psono-client/config.json:/usr/share/nginx/html/config.json \
  -v /opt/docker/psono-client/config.json:/usr/share/nginx/html/portal/config.json \
  -p 10200:80 psono/psono-combo:latest
# the admin portal also needs MANAGEMENT_ENABLED: True in settings.yaml (default False)

vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Psono is solid software with thin operational documentation, and both of those matter before you commit a vault to it:

non-negotiableBacking up the database is not backing up the vault. settings.yaml holds secrets the server needs to decrypt what is stored in Postgres, so a database-only backup restores to ciphertext nobody can read. Back up the file and the database together, and test a restore on a throwaway box before you trust the arrangement.

non-negotiableBudget for two machines, not one. Upstream sizes a sub-100-user install at 1 GB of RAM for the server and a separate 1.5 GB VM for Postgres, and is explicit that the database should not share a box with the application. The figure on this page is the single-box sum; if you follow the documented split, plan for two.

non-negotiableThe community/enterprise split is real but poorly documented. Single sign-on, audit logging, and centrally enforced policies belong to the enterprise build, and the first-party page that used to compare the editions is currently unreachable — so confirm any feature you are counting on directly with upstream instead of assuming it ships in the community edition.

An alternative to

1Password →

Head-to-head

Password managerAug 2026

Psono

Passbolt

Two team vaults, two very different licences.

Read the verdict →

More in Password manager

Password managerBitwarden

The official self-hostable Bitwarden server — full vendor support and enterprise SSO. Heavier than Vaultwarden, but the right pick when you need a supported, on-prem deployment.

C#SQL Server

moderateRead guide →

Password managerKeeWeb

A self-hostable web and desktop client for KeePass kdbx vault files — not a sync server. You host a single-page app behind your own domain and point it at a vault stored on local disk, WebDAV, or a cloud drive, so there is no database and no account system to run.

JavaScript

easyRead guide →

Password managerPassbolt

A team password manager built on OpenPGP — every secret is encrypted to each user's own key and shared through folder-level permissions, so the server only ever holds ciphertext. The community edition is free to self-host; SSO, LDAP provisioning, audit logs, and password policies are pro-only.

PHPCakePHPMariaDB

moderateRead guide →

Password managerTeamPass

A shared credential vault built for IT teams rather than individuals, organised as a folder tree with per-folder access rules, per-user encryption keys, and a full audit trail. One of the longest-running projects in this category, and it runs on the boring, familiar PHP plus MariaDB stack.

PHPMariaDB

easyRead guide →

Common questions

Does Psono need its own database?

Yes — PostgreSQL, and you have to provision it yourself before the container will start. The official CE install assumes a Postgres server already accepting connections, then runs a migrate step against it before the app comes up.

What is the difference between Psono CE and the enterprise edition?

The community edition is Apache-2.0 and unlimited on users, covering vaults, groups, sharing, and API keys. The enterprise edition adds LDAP/SAML/OIDC single sign-on, audit logging, and centrally enforced policies.

Is Psono harder to set up than Vaultwarden?

Noticeably, yes. Where Vaultwarden is one container and a volume, Psono wants an external Postgres, a generated server keypair, a hand-written settings.yaml, and a client config.json — budget an evening rather than five minutes.

What do I need to back up on a Psono server?

Two things, and missing either one loses the vault: the PostgreSQL database and the settings.yaml file. Psono's own docs are explicit that settings.yaml holds secrets needed to decrypt what is in the database, so a database-only backup restores to unreadable ciphertext.