Passbolt
Open source, end-to-end encrypted password and secret management for teams of 5 to 5,000
By Passbolt SA · HQ Belvaux, Luxembourg · 4.3/5 Value-Position score (estimate)
Positioning guardrails
Best for
- Security-conscious IT and DevOps teams that need self-hosted, end-to-end encrypted credential sharing
- Regulated and public-sector organisations (government, defence, universities, healthcare) with sovereignty or air-gap requirements
- Teams needing granular per-secret permissions and cryptographically verifiable audit trails
- DevOps teams automating secret retrieval and rotation through the API, CLI and SDKs
- Organisations standardising on Microsoft or Google SSO, LDAP/AD provisioning or SCIM
Ideal size: 5–5,000 people · Security-conscious scale-up or enterprise with IT/DevOps owning credentials
Not for
- Teams that want a plug-and-play cloud vault with no server, installer or admin overhead
- Organisations needing FedRAMP, HIPAA or ISO 27001 attestations out of the box
- Small groups that only need free shared passwords and no provisioning, SSO or audit controls
Value metrics scorecard
Time-to-Value
1–2 weeks
~7 days to first production value
Total Cost of Ownership
$5,880/yr
Starts at $588 · Per user, per month, billed annually; self-hosted Pro from $4.90/user/month (10-user minimum). Community Edition free; Enterprise quoted custom.
Implementation Friction
2/5
Engineering + admin effort required
Value-Position score
out of 5 · model estimate
Full cost breakdown
Mandatory implementation fee
None
Seat tiers
Community Edition: unlimited users, free. Pro: 10-user minimum, volume discounts after 100 users. Enterprise: custom, unlimited users.
Add-on costs
- Enterprise Edition tier: custom quote covering 4-hour SLA, high availability and disaster recovery consulting, white glove migration and hosting
Company & support
Who is behind Passbolt, and how your team gets help once it is live.
Company
- Founded
- 2017 · 9 yrs in business
- Headquarters
- Belvaux, Luxembourg
How you get support
- PhoneEnterprise only
- EmailPaid plans
- Live chatNot listed
- Support portal / ticketsNot listed
- Community forumAll plans
- Help centre / docsAll plans
- Dedicated account managerNot listed
- In person / on-siteNot listed
- Hours
- Business hours
- Response time
- Next business day (Pro); 4 hours within business hours (Enterprise SLA)
Support is available only to Pro/Cloud customers; Community Edition users rely on the community forum and online documentation. Business hours are Monday 9AM to Friday 6PM CET.
“Not listed” means the vendor’s public pages don’t mention that channel, not that it is unavailable. Ask about it during evaluation.
Market position
Where Passbolt sits against its closest alternatives. Pick any two of cost, speed, friction and buyer score, and up to 9 companies to compare.
Quadrant view
Typical annual cost × Time-to-value
The lines cross at the median of the solutions shown, so about half sit on each side of each line. A dashed ring marks an outlier pinned to the edge; hover for its value.
Companies on the chart 6 / 10
- Passbolt
- Virtru
- KnowBe4
- Backblaze
- UpGuard
- EasyLlama
Add or change companies
Up to 10 companies including Passbolt. Listed closest first.
Stack fit signal
Compatibility with standard B2B ecosystems.
No supported MCP path today, so it cannot be driven from an AI client.
AI & MCP readiness
What Passbolt ships in AI, and what it asks of your ecosystem.
Compliance attestations
* IAPP AIGP certifies individuals, not products. It means named staff hold the credential — not that the platform does.
Bottom line
Passbolt is an open source, end-to-end encrypted password and secret management platform for teams of 5 to 5,000. It covers workforce password sharing, privileged access management and DevOps secret automation, with per-secret permissions, SSO/LDAP/SCIM integration and cryptographically verifiable audit trails. Deployment is self-hosted (Community, Pro, Enterprise) or in a European cloud, and it is used by governments, defence, universities and regulated industries. Paid plans start at $4.90 per user per month billed annually, 10-user minimum.
Frequently asked questions
How is Passbolt priced?
Community Edition is free and unlimited (AGPLv3). Pro is $4.90 per user per month billed annually with a 10-user minimum and volume discounts after 100 users, adding LDAP provisioning, SSO, account recovery, activity logs and next-business-day support. Enterprise is a custom quote adding high availability and disaster recovery consulting, white glove migration and a 4-hour phone and email SLA.
Do we have to self-host Passbolt?
No. Passbolt can run self-hosted behind your firewall (air-gapped if needed) via turn-key installers, Docker or a virtual machine, or you can use Passbolt Cloud hosted in Europe. The first 7 days of Passbolt Cloud are free, and Community, Pro and Enterprise share one open source codebase, so editions can be switched with a subscription key.
What compliance and assurance does Passbolt offer?
Its security page states a successful SOC 2 Type II audit in 2021 and a GDPR audit by Examin, with the code, browser extension and API regularly audited by third parties such as Cure53 and Quarkslab; reports are public or available to customers on demand. ISO 27001, HIPAA and FedRAMP are not claimed, so buyers in those regimes must validate separately.
How are secrets protected technically?
Secrets are end-to-end encrypted with OpenPGP on the client; each user's private key is generated and stored on their device and never sent to the server in clear text. Authentication combines a passphrase with proof of private key ownership (GpgAuth) as built-in 2FA, plus an optional security token and additional MFA factors; permissions are set per secret and each secret is signed for a verifiable audit trail.
Can Passbolt fit our identity and tooling stack?
Pro and Enterprise support SSO with Microsoft, Google, OpenID and AD FS, LDAP/AD user and group provisioning, and SCIM. Passbolt is API-centric with CLI and SDKs, so teams can automate retrieval and rotation of tool secrets and machine credentials inside existing CI/CD pipelines, and administrators can export activity logs to their own monitoring systems.
What support do we get on each edition?
Support is only offered to Pro and Cloud customers. Pro includes next-business-day support; Enterprise adds a 4-hour phone and email SLA during business hours (Monday 9AM to Friday 6PM CET). Community Edition users rely on the community forum and the public documentation.