Passbolt
By Passbolt SA
Passbolt is an open-source password manager built for teams, which can run it on their own servers or use Passbolt's cloud hosted in Europe. The self-hosted Community Edition is free for any number of users, and paid plans start at $4.90 per user a month with a 10-user minimum.
- From
- $4.90 a month
- Free plan
- Yes
- Free trial
- 14 days
Pricing
Taken from the vendor's pricing page. Free trial: 14 days.
| Plan | Price | Charged | Notes |
|---|---|---|---|
| Community Edition | Free | unlimited users | Self-hosted. No single sign-on, LDAP, activity log or password policies. |
| Pro Edition | $4.90 a month | per user | Self-hosted. Billed annually. Minimum 10 users. |
| Cloud Business | $4.90 a month | per user | Hosted by Passbolt in Belgium and Germany. Billed annually; $5.40 billed monthly. Minimum 10 users.source |
| Cloud Sovereign | $8 a month | per user | Hosted in a private data center in Luxembourg. Billed annually. Minimum 10 users.source |
| Enterprise | On request | custom | Self-hosted or cloud, with a 4-hour support response time |
Costs not in the plan price
- Pro, Cloud Business and Cloud Sovereign require at least 10 users.
- LDAP and Active Directory provisioning are not part of Cloud Business.
- Cloud annual plans are bought in user tiers; going over the paid count is invoiced at the next tier straight away, and the count does not shrink by itself.
- Self-hosted editions run on servers you provide and maintain.
Categories it qualifies for
Facts we checked
- Passbolt's code, including the paid Pro edition, is open source under the AGPLv3 license. Source
- Encryption is based on OpenPGP, and each user's secret key is never sent to the server in cleartext. Source
- Passbolt publishes third-party audit reports, including Cure53 audits from 2021 to 2026 and a Quarkslab evaluation of Pro version 5.4. Source
- Passbolt's SOC 2 Type II audit was carried out by Johanson Group, and customers can request the report under a non-disclosure agreement. Source
- On October 29, 2026, Passbolt released fixes in Pro version 5.17 for a high-severity server-side request forgery issue and a weakness in its limit on repeated MFA attempts, and advised all administrators to update. Source
- Passbolt keeps a public list of past vulnerabilities and outages going back to 2017. Source
Security and compliance
- SOC 2
- Yes
- ISO 27001
- Not stated
- GDPR
- Yes
- HIPAA
- Not stated
- Single sign-on
- Pro Edition (self-hosted) or Cloud Business plan and up
Taken from the vendor's security page.
Contract terms
- Annual contract required
- No
- Minimum seats
- 10
- Renews automatically
- Not stated
- Cancellation
- Cloud customers can end the service with notice; prepaid fees are not refunded for a termination of convenience.
- Data export
- An encrypted KeePass (KDBX) file. Plain CSV export has been off by default since version 5.10 and an administrator can turn it on in the server settings.source
Taken from the vendor's terms.
Reviews
Review collection has not opened yet, so there are no reviews to show. When it opens, reviewers will confirm their identity with a work email or LinkedIn before a review is published.
Who pays us
Passbolt SA does not pay us anything.