Description
Passbolt is an open-source, self-hostable password manager designed for teams and organisations that prioritise privacy, security, and data ownership. It uses end-to-end OpenPGP encryption, ensuring that only authorised users can access stored credentials. The platform is fully auditable, with multiple independent security audits conducted in 2025, including a comprehensive white-box penetration test, which identified and addressed several vulnerabilities.
Passbolt's self-hosting capability allows organisations to maintain full control over their data, making it a compelling choice for those concerned about data sovereignty and compliance with regulations like GDPR. The platform offers granular sharing, fine-grained permissions, and detailed audit logs. Recent updates have introduced custom fields, improved user and group management, and secret history, enhancing both functionality and usability.
However, Passbolt is not without its challenges. In March 2025, a minor incident during a cloud deployment briefly disrupted service, though no data was compromised. In August 2025 a browser extension clickjacking vulnerability was published, Passbolt is affected by the issue and didn't release updates to protect its users against this attack vector as far as we know. The platform's user interface has been criticised as somewhat clunky. Additionally, while Passbolt's cloud hosting is based in Europe, it uses infrastructure from major providers like AWS and Google Cloud, which raises privacy concerns.
Summary
Passbolt is an open-source, self-hostable password manager designed for teams and organisations that prioritise privacy, security, and data ownership. It uses end-to-end OpenPGP encryption, ensuring that only authorised users can access stored credentials. Passbolt can be hosted on your own infrastructure or in the cloud, with the latter hosted in Europe, providing strong privacy protections under GDPR. The platform is regularly audited for security and compliance, and its code is fully open-source. While Passbolt is highly regarded for its security model and self-hosting flexibility, its user interface and feature set may not be as polished as some commercial alternatives.