What is Passbolt used for?

Passbolt is listed as a Security tool on TiloBox. Review the overview, features, and official documentation on this page to decide whether it solves your specific workflow.

How do I get started with Passbolt?

Start with the project's GitHub repository and official website for supported installation and deployment instructions. Test the setup with representative data or a small project before rolling it out more widely.

What license does Passbolt use?

Passbolt is listed under the AGPL-3.0 license. Read the complete license text and the project's notices before using, modifying, or distributing the software.

Is Passbolt ready for production use?

Production readiness depends on your requirements. Review maintenance activity, security practices, documentation, backup and upgrade procedures, and compatibility with your stack; then validate it in a non-production environment.

Is Passbolt an alternative to Bitwarden?

Passbolt is listed as an alternative to Bitwarden. Compare the core workflow, deployment model, integrations, and licensing against your must-have requirements before switching.

Security Alternative to Bitwarden Alternative to KeePass Alternative to 1Password Alternative to LastPass

Passbolt

Open-source, privacy-first credential and password manager for enterprise teams.

View on GitHub Visit website

LicenseAGPL-3.0

GitHub stars6.1k

Last commit1 weeks ago

Tags6 topics

Password ManagerTeam PasswordsSelf HostedPhpOpenpgpSecurity

Overview

Why consider Passbolt?

Passbolt is an open-source password manager designed for teams. Built on OpenPGP end-to-end cryptography, it enables secure password sharing, folder permissions, and audit logs.

Guided learning

Learn Passbolt by building

Practical setup notes, real use cases, and copy-ready examples in one focused guide.

3 min read 10 sections

In this guide10 sections

What is Passbolt?

Passbolt is an open-source, security-focused password manager designed specifically for agile teams, systems engineers, and enterprise organizations. Developed in PHP and CakePHP with OpenPGP.js, Passbolt provides an on-premises, privacy-first alternative to proprietary team password managers like 1Password Teams and LastPass Enterprise.

Passbolt is built on OpenPGP end-to-end cryptography: every credential is encrypted client-side using the recipient's public PGP key before being transmitted to the server. The server never has access to plaintext secrets or private decryption keys.

Who Is It For?

DevOps & Sysadmin Teams: Sharing SSH keys, server credentials, database passwords, and API keys securely across technical teams.
Security-Conscious Enterprises: Requiring mathematically verifiable OpenPGP cryptography and complete data sovereignty for secret management.
IT Service Providers & MSPs: Managing client credential folders with granular read, update, and administrative sharing permissions.

Key Features

End-to-end OpenPGP encryption: All secrets are encrypted client-side with user GPG/PGP keys before server storage.
Granular team folder permissions: Share passwords and credential folders with individual users or role-based groups (Can Read, Can Update, Can Admin).
Browser extensions for Chrome, Firefox, Edge, and Brave with automatic credential autofill and password generation.
Complete cryptographic audit logs: Track secret creation, views, modifications, and permission delegations with tamper-evident logs.
Command-line interface (passbolt-cli) and REST API for continuous integration pipeline secret injection.

Deploying Passbolt Community Edition with Docker Compose

yaml

1version: '3.8'

3services:

4 passbolt:

5 image: passbolt/passbolt:latest-ce

6 container_name: passbolt_server

7 restart: unless-stopped

8 ports:

9 - "8080:80"

10 - "8443:443"

11 environment:

12 - APP_FULL_BASE_URL=https://passbolt.example.com

13 - DATASOURCES_DEFAULT_HOST=db

14 - DATASOURCES_DEFAULT_USERNAME=passbolt

15 - DATASOURCES_DEFAULT_PASSWORD=secure_passbolt_db_pass

16 - DATASOURCES_DEFAULT_DATABASE=passbolt

17 - EMAIL_DEFAULT_TRANSPORT=Smtp

18 - EMAIL_DEFAULT_FROM=passbolt@example.com

19 - EMAIL_DEFAULT_HOST=smtp.mailtrap.io

20 - EMAIL_DEFAULT_PORT=587

21 volumes:

22 - ./gpg:/etc/passbolt/gpg

23 - ./jwt:/etc/passbolt/jwt

24 depends_on:

25 - db

27 db:

28 image: mariadb:10.11

29 container_name: passbolt_db

30 restart: unless-stopped

31 volumes:

32 - ./mariadb_data:/var/lib/mysql

33 environment:

34 - MARIADB_DATABASE=passbolt

35 - MARIADB_USER=passbolt

36 - MARIADB_PASSWORD=secure_passbolt_db_pass

37 - MARIADB_ROOT_PASSWORD=root_secure_password

Start the containers:

bash

1docker compose up -d

Create the first administrator user:

bash

docker compose exec passbolt su -m -c "/usr/share/php/passbolt/bin/cake passbolt register_user -u admin@example.com -f Admin -l User -r admin" -s /bin/sh www-data

Follow the generated onboarding link in the terminal to set up your OpenPGP private key inside the Passbolt browser extension.

Practical Use Cases

A systems team organizes infrastructure passwords into hierarchical folders ("Production Databases", "Staging Kubeconfig"), granting junior engineers read-only access while retaining edit permissions for senior architects.

2. Client Secret Handoff for Digital Agencies

An agency receives API tokens from external clients, storing them securely in a dedicated Passbolt client vault shared only with project team members.

3. CI/CD Secret Retrieval

A deployment script uses passbolt-cli to pull database connection secrets programmatically using the build server's dedicated GPG key.

Troubleshooting and Limitations

Browser Extension Mandatory: Passbolt requires the official browser extension (or mobile app) to perform client-side OpenPGP decryption; the web interface cannot be accessed without the extension.
GPG Key Backup: The GPG server keys located in /etc/passbolt/gpg are critical for system operation; back up this directory securely.

Official Resources

Official Website: https://www.passbolt.com
GitHub Repository: https://github.com/passbolt/passbolt_api
Documentation: https://help.passbolt.com

Related tools

More options with a similar category or technology profile.

boringproxy

Simple, self-hosted reverse proxy and tunnel manager for exposing private web services securely.

OWASP ModSecurity

Open-source Web Application Firewall (WAF) engine providing cross-platform HTTP security inspection.

OpenCTI

Open-source platform for managing cyber threat intelligence knowledge and STIX2 relationships.

Maltrail

Malicious traffic detection system utilizing public blacklists and heuristic traffic behavior analysis.