Passbolt

Last reviewed Sep 13, 2026 · 757 words

Passbolt makes sense for a team and almost never for an individual. Its model is OpenPGP: every user holds a private key in their browser extension, every secret is encrypted separately to each person it is shared with, and the server never sees a plaintext password even for a moment. That buys fine-grained sharing, role-based folders, and an audit log of who accessed what, which is exactly what a 5-to-50 person IT team needs. It also costs 1 GB of RAM, a MariaDB instance, a working SMTP relay before the first user can even sign up, and a setup that the catalogue fairly rates Medium. For a household, Vaultwarden does the job on 128 MB.

The encryption model is the reason to choose it

Bitwarden-style vaults encrypt everything with a key derived from the master password; sharing means an organisation key that members hold. Passbolt encrypts each secret to each recipient's public key individually. Revoke a person and their copies simply stop being re-encrypted; nobody else's keys rotate. Give a freelancer access to 3 passwords out of 400 and those are the 3 they can ever decrypt, verifiable from the database. The threat model that justifies this is "we have staff turnover and we share infrastructure credentials", which describes most small companies and almost no families.

The install has two non-negotiable dependencies

A database and an outbound mail server. Users are onboarded by email invite, and the link in that email is where they generate their key pair, so with no SMTP there are no users. Put both in the compose file from the start:

services:
  db:
    image: mariadb:11
    environment:
      - MARIADB_ROOT_PASSWORD=change-me
      - MARIADB_DATABASE=passbolt
      - MARIADB_USER=passbolt
      - MARIADB_PASSWORD=change-me-too
    volumes:
      - ./db:/var/lib/mysql
  passbolt:
    image: passbolt/passbolt:latest-ce
    depends_on: [db]
    environment:
      - APP_FULL_BASE_URL=https://passbolt.example.com
      - DATASOURCES_DEFAULT_HOST=db
      - DATASOURCES_DEFAULT_USERNAME=passbolt
      - DATASOURCES_DEFAULT_PASSWORD=change-me-too
      - DATASOURCES_DEFAULT_DATABASE=passbolt
      - EMAIL_TRANSPORT_DEFAULT_HOST=smtp.example.com
      - EMAIL_TRANSPORT_DEFAULT_PORT=587
      - [email protected]
      - EMAIL_TRANSPORT_DEFAULT_PASSWORD=smtp-secret
      - [email protected]
    volumes:
      - ./gpg:/etc/passbolt/gpg
      - ./jwt:/etc/passbolt/jwt
    ports:
      - "443:443"

Then create the first administrator from inside the container:

docker exec passbolt su -s /bin/bash -c \
  "./bin/cake passbolt register_user -u [email protected] -f Ada -l Lovelace -r admin" www-data

It prints a URL; open it in a browser with the Passbolt extension installed to finish. APP_FULL_BASE_URL must match the real HTTPS address exactly, and the gpg volume holds the server's own key pair, generated on first boot. Lose that directory and every stored secret is unrecoverable, so it goes into backups alongside the database dump.

The browser extension is mandatory, not optional

There is no usable web-only mode. The private key lives in the extension, so every user installs it on Chrome, Firefox or Edge, and uses the Android or iOS app on phones. That is a deliberate security choice and a real adoption hurdle; a team that expects to open a URL and log in will push back. Each user also downloads a recovery kit containing their private key at signup. In Community Edition, a user who loses both the key and their browser profile loses access to their own account, and an admin cannot help. Account recovery workflows are among the features held for the paid tiers, along with LDAP directory sync, SSO, and enforced multi-factor policies. The password managers category notes which tools keep those in the free build.

Operating it: backups and upgrades

A restore needs three things: a mysqldump of the database, the gpg directory, and the jwt directory. Script all three nightly and test a restore into a scratch stack once, as the Vaultwarden guide preaches for the same reason. Upgrades follow the image tag; Passbolt runs database migrations on start and publishes a compatibility note with each release, and the extension auto-updates through the browser store, so the server and clients rarely drift.

What I'd do

For a team of 5 or more sharing infrastructure credentials, Passbolt CE behind a reverse proxy, MariaDB on the same host, a transactional email provider for SMTP, and the three-part backup on a nightly cron. Accept the extension requirement as a feature and say so at onboarding. For a family, a couple, or one person, do not do this; Vaultwarden gives you the same day-to-day experience with official Bitwarden clients and a fraction of the operational surface.