Self-host Psono

updated Aug 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Aug 2026 · how we test

We earn commissions when you shop through the links below. Full disclosure →

An end-to-end encrypted password manager aimed at IT teams, pairing a Django/PostgreSQL server with browser extensions and a built-in admin portal. The community edition has no user cap; SSO, audit logging, and policy enforcement live in the enterprise build.

Key facts

CategoryPassword manager

LicenseApache-2.0

StackPython, Django, PostgreSQL

Min RAM2560 MB

Official imageyes

Difficulty

Sourcegitlab.com/esaqa/psono/psono-server

Websitepsono.com

Our recommendation

Choose Psono when you want an end-to-end encrypted vault for an IT team with its own admin portal, groups, and API keys, and you don't care about Bitwarden client compatibility. It is the most assembly-required option in this category — external Postgres, generated server keys, a hand-written config — so pick it for the admin portal and the API, not for a quiet evening. If you mainly want a personal or small-group vault, Vaultwarden does that in one container; if team sharing is the point, Passbolt's per-user key model is the more rigorous design.

Follow the Psono deploy guide →

What you need

Any VPS with at least 2560 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About the better part of a day

Where to host itaffiliate disclosure

Hetzner Cloudrun it on

From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + US

Get Hetzner Cloud

Kamaterafree trial

From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + Asia

Start free on Kamatera →

DigitalOceanalso works on

From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + Asia

Deploy on DigitalOcean →

Paid link — we earn a commission if you shop through it.

Install

Run these commands on your server:

# Psono CE — Postgres, then the combo image (server + web client + portal)
docker run -d --name psono-db --restart=unless-stopped \
  -e POSTGRES_DB=psono -e POSTGRES_USER=psono -e POSTGRES_PASSWORD=CHANGEME \
  -v psono-db:/var/lib/postgresql/data postgres:16
sudo mkdir -p /opt/docker/psono /opt/docker/psono-client
docker run --rm psono/psono-combo:latest python3 ./psono/generateserverkeys.py
# copy the printed keys into /opt/docker/psono/settings.yaml (see the CE install doc
# for the template) and create psono-client/config.json before the next step
docker run --rm -v /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml \
  psono/psono-combo:latest python3 ./psono/manage.py migrate
docker run --name psono-combo --sysctl net.core.somaxconn=65535 -d --restart=unless-stopped \
  -v /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml \
  -v /opt/docker/psono-client/config.json:/usr/share/nginx/html/config.json \
  -v /opt/docker/psono-client/config.json:/usr/share/nginx/html/portal/config.json \
  -p 10200:80 psono/psono-combo:latest
# the admin portal also needs MANAGEMENT_ENABLED: True in settings.yaml (default False)

deploy guideHow to Deploy Psono on a VPS vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Psono is solid software with thin operational documentation, and both of those matter before you commit a vault to it:

non-negotiableBacking up the database is not backing up the vault. settings.yaml holds secrets the server needs to decrypt what is stored in Postgres, so a database-only backup restores to ciphertext nobody can read. Back up the file and the database together, and test a restore on a throwaway box before you trust the arrangement.

non-negotiableBudget for two machines, not one. Upstream sizes a sub-100-user install at 1 GB of RAM for the server and a separate 1.5 GB VM for Postgres, and is explicit that the database should not share a box with the application. The figure on this page is the single-box sum; if you follow the documented split, plan for two.

non-negotiableThe community/enterprise split is real but poorly documented. Single sign-on, audit logging, and centrally enforced policies belong to the enterprise build, and the first-party page that used to compare the editions is currently unreachable — so confirm any feature you are counting on directly with upstream instead of assuming it ships in the community edition.

An alternative to

1Password →

Head-to-head

Password managerAug 2026

Psono

Passbolt

Two team vaults, two very different licences.

Read the verdict →

Password managerSep 2026

Psono

Vaultwarden

A single-container, 256 MB Bitwarden-compatible vault vs. a Django/PostgreSQL password manager built for IT teams with an admin portal and unlimited users in its community edition.

Read the verdict →

More in Password manager

Password manager

Common questions

Does Psono need its own database?

Yes — PostgreSQL, and you have to provision it yourself before the container will start. The official CE install assumes a Postgres server already accepting connections, then runs a migrate step against it before the app comes up.

What is the difference between Psono CE and the enterprise edition?

The community edition is Apache-2.0 and unlimited on users, covering vaults, groups, sharing, and API keys. The enterprise edition adds LDAP/SAML/OIDC single sign-on, audit logging, and centrally enforced policies.

Is Psono harder to set up than Vaultwarden?

Noticeably, yes. Where Vaultwarden is one container and a volume, Psono wants an external Postgres, a generated server keypair, a hand-written settings.yaml, and a client config.json — budget an evening rather than five minutes.

What do I need to back up on a Psono server?

Two things, and missing either one loses the vault: the PostgreSQL database and the settings.yaml file. Psono's own docs are explicit that settings.yaml holds secrets needed to decrypt what is in the database, so a database-only backup restores to unreadable ciphertext.