Passbolt is an open source credential platform for IT and security teams that need to store and share passwords and secrets without trusting the server that holds them. It suits teams from 5 to 5,000 users, in companies, universities, public bodies and NGOs.
The problem is that shared credentials are usually the weakest part of a team’s security: passed around in chat, kept in spreadsheets or held in tools whose server can read everything. Passbolt is built so that only the people a secret is shared with can ever decrypt it.
At A Glance
| Vendor | Passbolt SA |
|---|---|
| Category | Open source team password and secret manager |
| Identities covered | Human users, shared credentials, secrets, API tokens, TOTP entries |
| Deployment | Self-hosted (Docker, Helm, packages, air-gapped) or Passbolt Cloud hosted in Europe |
| Certifications | SOC 2 Type II, GDPR audit, public third-party security audits |
| Customers | Bosch, GLS, Humboldt-Universität zu Berlin, TU Graz, Cordaid |
| Market classification | Secrets Management |
What Passbolt Does
Many teams still keep shared passwords in spreadsheets and browsers, in home-grown tools, or behind all-or-nothing access. Passbolt replaces that with shared vaults and fine-grained permissions, so each person sees only the credentials they need and every change is logged.
Its security model rests on OpenPGP. The browser extension, not the server, carries out every critical cryptographic operation, which means a compromised server cannot read secrets or tamper with the code that protects them. “Passbolt is open source all the way, even the paid version”, so security teams can inspect what they run.
Products
Password And Secret Sharing
The core of Passbolt is a shared vault for passwords, secrets, TOTP entries and folders. Users sign in with their secret key and an extra 3-step verification, with phishing-resistant passkey MFA as an option. Role-based access control, sharing filters and password expiry keep each credential limited to the people who need it, and browser extensions, a CLI and an open API give access from wherever the team works.
Directory, Sign-On And Recovery
Larger organisations need Passbolt to fit their existing directory and sign-in. For them it adds:
- LDAP provisioning from Active Directory and OpenLDAP
- Single sign-on with Microsoft, Google, PingOne and OpenID
- Account recovery through escrow, so a lost key does not mean lost access
- An activity log for auditing changes, tags and a VM appliance
Passbolt Cloud
Passbolt Cloud is the hosted option for teams that would rather not run the server themselves. It is hosted in Europe.
How It Works
Passbolt runs either self-hosted or in the cloud. Self-hosted installs use Docker Compose, Helm or native packages for apt, dnf and zypper, and the platform can run in an air-gapped environment.
| Component | What it does |
|---|---|
| OpenPGP keys | Every user has a PGP secret key, either supplied or generated when the account is created. That key is never sent to the server in cleartext. |
| Browser extension | The extension performs encryption and decryption, and its updates roll out automatically by default. |
| Server | The server is a standalone component. By default it needs no third-party service and can run without internet access. |
| Clients | iOS and Android apps, a Windows desktop app and the CLI sit alongside the browser extensions. |
Identities And Systems Covered
| Human users | Workforce users storing and sharing credentials in team vaults |
|---|---|
| Credentials and secrets | Passwords, secrets, TOTP entries, PIN codes, and key-value or API token credential types |
| Machine credentials | Shared machine credentials managed by teams |
| Directories | User accounts provisioned from Active Directory and OpenLDAP |
Company Background
| Legal entity | Passbolt SA |
|---|---|
| Headquarters | Luxembourg |
| Founders | Kevin Muller, Cedric Alfonsi and Remy Bertot |
| Adoption | More than 50,000 reported organisations worldwide |
| Funding | An $8 million Series A in January 2025 led by Airbridge Equity Partners, with Expon Capital’s Digital Tech Fund, ScaleFund, Seeder and others |
| Security audits | Cure53 audits in 2021 and of the Windows app in 2024, SOC 2 Type II in 2021, a GDPR audit by Examin in July 2026, and a Quarkslab audit in November 2025 as a pre-evaluation step towards ANSSI CSPN certification |
Note: This overview is compiled from Passbolt’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.