Passbolt review: private password sharing for teams

Passbolt Community Edition is a free open-source password manager for teams that want to organise and share logins.¹ It is a good choice for a small business, club or volunteer group with someone able to look after a server. Its main privacy appeal is choosing where the shared vault lives and keeping password access limited to the right people.

Last checked October 28, 2026.

At a glance

• What it is: A password manager built around team sharing.
• Works on: Chrome, Brave, Firefox, Vivaldi, Edge and Safari browser extensions; iOS and Android apps; a Windows desktop app; a Linux server for self-hosting.⁴³
• Price: Community Edition is free with unlimited users.³ Budget separately for hosting and maintenance.
• Licence: GNU AGPL version 3 for the community server.¹
• Best for: Groups wanting control over a shared password service.
• Official site: passbolt.com

What Passbolt does and how it protects your privacy

Think of Passbolt as a shared key cabinet. Start with the accounts your group needs together, such as a website login or shared supplier account. Decide who needs each login before adding it. The useful change is having a deliberate place for shared credentials rather than scattering copies through messages.

Passbolt encrypts passwords on your device before sending them to the server.⁵ Encryption scrambles readable information so that opening it requires the right key. Self-hosting means your group runs the service, either on its own equipment or on rented infrastructure.

The latest server release is 5.17.0, published on October 20, 2026.² This is an actively maintained project. For Community Edition, nominate a person responsible for updates and backups before moving important accounts into it.

Passbolt Community Edition key features

• Shared folders: Keep related team logins together alongside private folders.³
• People and groups: Organise access around the people working together.³
• Password generation and autofill: Create passwords and fill website forms through the extension.⁴
• Mobile access: Search passwords, fill forms and create passwords on iOS or Android.⁴
• Passkey protection: Version 5.17 supports passkeys as an extra sign-in factor in every edition.² A passkey uses your device or a security key to confirm a sign-in.
• Sharing previews: Moving an item shows who will gain, lose or keep access before confirmation.²

Passbolt pros and cons

Pros

• Free team sharing makes a small pilot affordable.
• Choosing your server gives your group a clear hosting decision.
• Private and shared folders provide a sensible starting structure.
• Browser and phone access suit everyday team work.

Cons

• Running a server needs an owner, time and a maintenance budget.
• The browser workflow requires an extension.⁴
• Administrator-assisted account recovery is listed as a Pro feature.³
• Single sign-on and activity logs are also Pro features.³
• People need a careful introduction to passphrases and recovery files.

Self-hosted Pro costs US$4.90 per user per month, billed annually, with a ten-user minimum.³ Compare Passbolt Cloud separately if your group would prefer managed hosting. Choose the edition around the help your team needs, especially when somebody loses access.

Is Passbolt safe and private?

Passbolt SA develops the product and is based in Luxembourg.⁸ Its open code and published assessments make it a worthwhile option for privacy-conscious teams. Treat those as reasons to consider it alongside the practical question of who will operate it responsibly.

The repository says Passbolt does not collect telemetry.¹ Telemetry means information sent back about software use. However, the Android store declaration says the app may collect personal information and app activity, while declaring no third-party sharing.⁸ These statements should be read in their own context; do not assume every client has an identical data declaration.

Secret values are always encrypted, while encrypting names, website addresses and descriptions depends on the organisation’s configuration.⁵ Ask your administrator about metadata encryption before adding revealing account titles. Metadata is the descriptive information around a password.

In 2025 Passbolt commissioned Quarkslab to perform a security audit and a pre-CSPN evaluation, a readiness check against the expectations of ANSSI, France’s cybersecurity agency. Passbolt’s published summary says the audit found no critical vulnerabilities, one medium-severity issue, two low-severity issues and three informational findings.⁷ Passbolt says those findings have either been addressed, incorporated into the product roadmap, or resulted in improvements to its documentation and hardening guidance. That summary describes one assessment, not a guarantee for every installation. Keep devices updated and review access when roles change.

How to get started with Passbolt

1. Begin at the official downloads page and follow its Community server installation link. Agree who will maintain the service and its backups.
2. Open the invitation email sent by your administrator and follow its setup link.⁶ Confirm the address with your administrator if anything looks unfamiliar.
3. Install the browser extension using the official setup flow. Pin it somewhere easy to find.
4. Choose your passphrase, save the recovery kit and set the colour-and-letter security token.⁶ Store the kit somewhere protected and separate from your everyday device.
5. Start with a low-risk login and one teammate. Review the sharing preview together before adding more accounts.
6. Ask the administrator to enable an extra sign-in factor, then enrol it in your profile. For background reading on separate code apps, see Proton Authenticator.

Who should use Passbolt, and who might prefer something else?

Passbolt Community Edition is a strong candidate when sharing is the main problem and someone can manage the service. Pilot it with the people who will actually use it. Include adding a phone, changing a shared login and explaining the recovery kit in that trial.

If running a server feels like too much responsibility, compare Bitwarden. For a personal Android vault, consider KeePassDX. For occasional encrypted text sharing, explore PrivateBin as a separate option. Choose around the job you need done, rather than collecting overlapping tools.

Frequently asked questions

Is Passbolt Community Edition really free?

Yes: the Community software has no per-user charge.³ Hosting, backups and the person’s time to maintain it still belong in your budget. Decide who pays for those before inviting the whole group.

Does Passbolt work on iPhone and Android?

Yes, official mobile apps are available.⁴ Start from Passbolt’s downloads page or the app-store links in its repository, and confirm the publisher before installing.

What happens if I lose my recovery kit?

Without enabled account recovery, the recovery kit is the only way to regain account access.⁵ Make protecting that file part of onboarding, rather than a task to remember later.

Can Passbolt replace a password with a passkey?

In version 5.17, passkeys provide an additional sign-in factor; passwordless sign-in and storing other websites’ passkeys are planned for later releases.² Keep the distinction clear when explaining the feature to teammates.

Sources

1. Passbolt: Community Edition source repository
2. Passbolt: 5.17.0 release notes
3. Passbolt: self-hosted editions and pricing
4. Passbolt: official downloads
5. Passbolt: how your data is secured
6. Passbolt: first setup
7. Passbolt: pre-CSPN security audit results
8. Google Play: Passbolt Android listing and data safety