Self-host TeamPass

deployed & timed by usprices checked · Aug 2026

A shared credential vault built for IT teams rather than individuals, organised as a folder tree with per-folder access rules, per-user encryption keys, and a full audit trail. One of the longest-running projects in this category, and it runs on the boring, familiar PHP plus MariaDB stack.

Key facts

CategoryPassword manager

LicenseGPL-3.0

StackPHP, MariaDB

Min RAM1024 MB

Dockeryes

Difficulty

Our recommendation

Reach for TeamPass when a team needs controlled access to shared credentials and you want it on the most boring stack available — PHP and MariaDB, a folder tree, per-folder permissions, roles, and an audit trail of who read what. It is still actively developed and it is the lightest of the team-oriented options here. For a personal vault it is all overhead and Vaultwarden is the answer; if you want sharing enforced by per-user encryption keys rather than application-level ACLs, Passbolt is the stricter model.

What you need

Any VPS with at least 1024 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
Under an hour if you've used Docker before

Install

Run these commands on your server:

# TeamPass — official compose quick start (app + MariaDB)
git clone https://github.com/nilsteampassnet/TeamPass.git
cd TeamPass/docker/docker-compose
cp .env.example .env   # set DB_PASSWORD and MARIADB_ROOT_PASSWORD
sed -i 's/^TEAMPASS_VERSION=.*/TEAMPASS_VERSION=latest/' .env
# .env.example pins an image tag that is no longer on Docker Hub — pin your own once it's up
docker compose up -d
# then open http://SERVER_IP:8080 and run the installation wizard

vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

TeamPass is easy to stand up and easy to lose — the failure modes are all about what lives outside the database:

non-negotiableThe encryption saltkey is separate from the database, and losing it loses everything. Stored secrets are encrypted against that key, so a database backup on its own restores rows nobody can decrypt. Back up the saltkey volume with the database, and keep a copy somewhere the database backup isn't.

non-negotiableThe upstream documentation contradicts itself. There are two divergent quick-starts and at least one dead internal link, so following the first page you land on is a real way to end up with a half-configured install. Work from the compose files in the repository, read the wizard's prompts carefully, and cross-check anything that looks off rather than guessing.

non-negotiableThere are no mobile apps. A browser extension for autofill and capture exists for Chrome, Firefox, and Edge, but away from a desktop browser TeamPass is a web app you log into — plan for that before you hand it to a team that works from phones.

An alternative to

1Password →

More in Password manager

Password managerBitwarden

The official self-hostable Bitwarden server — full vendor support and enterprise SSO. Heavier than Vaultwarden, but the right pick when you need a supported, on-prem deployment.

C#SQL Server

moderateRead guide →

Password managerKeeWeb

A self-hostable web and desktop client for KeePass kdbx vault files — not a sync server. You host a single-page app behind your own domain and point it at a vault stored on local disk, WebDAV, or a cloud drive, so there is no database and no account system to run.

JavaScript

easyRead guide →

Password managerPassbolt

A team password manager built on OpenPGP — every secret is encrypted to each user's own key and shared through folder-level permissions, so the server only ever holds ciphertext. The community edition is free to self-host; SSO, LDAP provisioning, audit logs, and password policies are pro-only.

PHPCakePHPMariaDB

moderateRead guide →

Password managerPsono

An end-to-end encrypted password manager aimed at IT teams, pairing a Django/PostgreSQL server with browser extensions and a built-in admin portal. The community edition has no user cap; SSO, audit logging, and policy enforcement live in the enterprise build.

PythonDjangoPostgreSQL

hardRead guide →

Common questions

Is TeamPass meant for personal use?

Not really — it is built around shared folders, roles, and per-folder permissions for a team, so a single user gets a lot of administration for very little benefit. For a personal vault Vaultwarden is the lighter choice; TeamPass earns its keep when several people need controlled access to the same credentials.

What has to be backed up on a TeamPass server?

The MariaDB database and the encryption saltkey volume, together. The saltkey is what the stored secrets are encrypted against, so a database-only backup restores rows nobody can decrypt — the upstream docs flag it as the critical volume for exactly this reason.

How do I install TeamPass with Docker?

Clone the repo, copy the sample .env in docker/docker-compose and set the two database passwords, then run docker compose up -d. The image ships with MariaDB alongside it, and the remaining setup happens in a browser-based installation wizard on first visit.

How does TeamPass differ from Vaultwarden?

TeamPass is a web application you log into, designed for team credential governance — folder ACLs, roles, and an audit log of who read what. Vaultwarden is a Bitwarden-compatible sync server, so its strength is the official browser and mobile clients autofilling personal vaults; it has no equivalent of TeamPass's folder-level administration.