TeamPass

Last reviewed Sep 13, 2026 · 834 words

The people who run TeamPass in 2026 are IT teams with a shared credential problem: 40 servers, 12 vendor portals, a rotating cast of consultants, and an auditor who wants to know who saw the root password last March. The folder tree with per-role rights maps directly onto how those teams already think, which is why a PHP application first released in 2010 still gets updates and holds 1,826 GitHub stars. If you are a household or a solo homelabber, that same structure is overhead you do not need, and Vaultwarden is the better pick. Read on if you are the IT team.

Folders and roles are the model, and they are the point

TeamPass organises everything as folders. Each folder holds items (a credential, its URL, notes, attachments), and each role is granted read, write or no access per folder, with users belonging to one or more roles. On top of that you can mark individual items as personal, restrict them to named users, set expiry dates, and require a reason before an item is shown. Every view and edit lands in an audit log you can export.

This is deliberately different from the Bitwarden model, where sharing is per-collection inside an organisation. TeamPass assumes hierarchy: a Networks folder with a Firewalls subfolder that only the network role can open, a Vendors folder the helpdesk can read but not edit. If your team's access rules look like an org chart, TeamPass fits. If they look like a flat list of people who all need everything, you are paying for complexity you will never use.

The salt key is the file that ends careers

TeamPass encrypts item passwords with a key stored in a file the installer calls the salt key, placed by default in a directory outside the web root that you choose at install time. The database on its own is useless without it, which is the security property you want. It also means a backup that contains the database but not the salt key is a backup of nothing.

Back up both, separately, and test a restore into a scratch container before you trust it. The upgrade path also touches this key on some major versions and re-encrypts items in place, so read the release notes before every jump and take a snapshot first. I know of more than one team that lost a vault to a tidy sysadmin who deleted an "unused" directory.

The stack is plain PHP, which cuts both ways

TeamPass is GPL-3.0, written in PHP, and runs on a standard LAMP-style stack with MariaDB or MySQL. Docker or bare metal both work and 512 MB of RAM is plenty for a few hundred users. The upside is that any web host or existing PHP box can carry it. The downside is that PHP version bumps and the composer-managed dependencies are your problem, and the installer's list of required extensions and file permissions is long enough that the first install usually takes an afternoon. Budget for it.

The interface is the other honest con. It is functional, dense and visibly from an earlier era of web design. Teams who live in it stop noticing within a week; people who are used to a polished consumer password manager will complain on day one.

Where it beats Vaultwarden, and where it loses badly

TeamPass wins on granular folder permissions, item-level access reasons and expiry, LDAP and Active Directory login with group mapping, and an audit trail designed for compliance questions. It also has a REST API for pulling credentials into scripts, which is how most serious deployments use it.

It loses on everything client-side. There are no first-party browser extensions or mobile apps worth using, so autofill, mobile access and offline caching are absent. Vaultwarden gives you the official Bitwarden clients on every platform, plus organisations and collections that cover 80 percent of team sharing needs, on less RAM. Passbolt is the middle ground: built for teams, with a browser extension, a decent API and a more modern codebase, though its free edition also gates some group and audit features behind a paid tier. The password managers category has the rest of the field.

What I'd do

For an IT team with hierarchical access rules and a compliance requirement, I would run TeamPass on a small dedicated VM, MariaDB on the same box, the salt key on a separate backed-up path, LDAP login enabled, and a monthly restore test on the calendar. For everyone else, Vaultwarden. The features TeamPass adds are real, but they only pay for themselves once the number of people who must not see each other's passwords is larger than the number who must.