An open source credential platform for technical teams. The vault sits on your own server, browsers, phones and the command line all read the same data, and the keys are generated on the client.

Shared credentials, and the trouble that starts at sharing

A team holds more accounts than people. Servers, databases, internal systems, contractor logins: passphrases travel between chat logs, spreadsheets and sticky notes, and afterwards nobody can say who changed one, who looked at one, or whether access was withdrawn when someone left. That is the stretch Passbolt works on. It calls itself a credential platform for teams, aimed at those with a serious security habit, and it stresses that a group of five and an organisation of five thousand both fit.

The scale figure on the site is more than fifty thousand organisations worldwide, with government bodies, defence agencies and information technology companies among the listed sectors. The maker, Passbolt SA, is based in Luxembourg, treats European made as a formal selling point, and states that it has joined the FIDO Alliance.

The vault in your own hands: self hosting, containers or the cloud

The shape of the product settles where the data lives. Self hosting is the main line, installed on your own server or inside the firewall, and the offered routes are a direct package install, container orchestration or a deployment from source. The security page notes that it can run in an air gapped environment, meaning the machine is cut off from the outside network entirely, which is a hard requirement for classified and heavily regulated settings. The install script covers the main Linux distributions, and container images and virtual machine images offer two shortcuts.

For teams that would rather not maintain a server, there is a hosted edition in Europe, with data centres inside the European Union and each customer workspace kept in its own database with logical separation. Self hosted and hosted share the same clients, so switching does not mean relearning the habits.

End to end encryption and the OpenPGP key model

What separates this tool from the usual online password vault is where the encryption happens. Passbolt is built on OpenPGP, the open standard, and every member generates a key pair locally: the public key goes to the server, the private key stays on the device, and the original wording says the private key never passes through the server. Sharing an entry encrypts it with the recipient public key, and only the holder of the matching private key can open it.

One layer finer is per entry encryption. Each record is handled with its own key, so one leak does not drag the rest out with it, and the key rotates on every update, which avoids a single vault key being shared for years. Login asks by default for the private key plus a passphrase, a two factor combination, and an extra multi factor layer is available. Against phishing the interface shows a three letter token with a colour and checks it against the address, which makes a lookalike page hard to pass off.

Browser, phone and command line on one vault

Client coverage is one of the strengths here. The browser extension is the main door, handling autofill, strong password generation and site matching, mobile apps search and fill on the move, and a native program exists for the desktop. All three read the same encrypted data, so there is no case of a change landing in one place while another still shows the old value.

The route for operations and development is a command line tool plus a JSON interface. The listed commands cover create, delete, export, get, list, move and share, which lets the act of fetching a passphrase live inside a pipeline script: inject it as an environment variable during a deployment, discard it afterwards, and keep the credential out of the repository. The interface is fully open and an SDK is provided for a home made dashboard. The release tag in the official repository currently sits at 5.16.0.

Permission layers, audit trail and three licence tiers

With collaboration, everything turns on how finely permissions are cut. Passbolt organises them in three layers: folders, groups and roles. A private folder belongs to one person, a shared folder is granted by group, and roles follow role based access control alongside two principles, grant only what is needed and grant just in time, so access opens when required and closes straight afterwards, and the site notes that the withdrawal applies at the key level as well.

On the trail, administrators can read an activity log showing who fetched, changed or shared which credential and when, and it exports in system log format when it has to feed an existing system. On credentials, the site lists a SOC 2 Type II audit report and GDPR compliance, states that an independent third party penetration test runs at least once a year, adds a bug bounty programme, and publishes the audit reports. Data at rest in the hosted edition uses 256 bit AES.

Licensing runs in three tiers. The community edition is open source under AGPLv3, free forever, with no cap on members, and includes password and folder management, users and groups, two factor authentication, the browser extension and command line, the open interface and role based access control. Pro adds tag management, directory synchronisation, single sign on, account recovery and the activity log, at a published 4.9 dollars per user per month billed annually, from ten users, with volume discounts past one hundred. Enterprise is quoted on request and adds high availability and disaster recovery advice, managed migration and a shorter response time. The line ships a release on the second Wednesday of each month, and the roadmap is prioritised by community vote.

If a team needs its passphrases to stay on its own server and needs to account for every fetch, Passbolt offers a complete chain: OpenPGP end to end encryption underneath, three kinds of client on one vault, permissions and audit closing layer by layer, a community edition that is free to use, and the advanced capabilities sold by member count.