Passbolt Review (2026): Open Source from Luxembourg, Free to Self-Host

What is Passbolt?

Who is behind Passbolt

Passbolt is an open-source password manager for teams, made by Passbolt SA in Belvaux, Luxembourg. The idea started in 2011 in a digital agency that wanted a collaborative alternative to KeePass. After two prototypes, the first stable Community Edition was released under an open-source licence in 2016, and the founders incorporated the company in 2017 to work on Passbolt full time.

Passbolt Cloud followed in 2019. The company closed a €3 million funding round in 2020 and an $8 million round in 2024, and says it now has 2,000 customers, including governments and defence agencies. The team grew from 7 to 15 people in 2021 and reached 30 in 2023, according to its own timeline. Passbolt does not name its investors or owners on the pages I checked.

Where Passbolt hosts your data

That depends on the edition. With the Community or Pro Edition you install Passbolt on your own server – Passbolt provides install scripts for Debian, Ubuntu, Red Hat, openSUSE and others, a Docker container and a virtual machine. Passbolt says the server needs no third-party service and no internet connection to work, and does not send usage data or analytics back to the company.

If you do not want to run a server, Passbolt Cloud is hosted in Belgium and Germany in Google Cloud data centres – a US provider, even though the data stays in the EU. The Cloud Sovereign plan is hosted in a private, ISO 27001-certified data centre in Luxembourg, with no US cloud involved. The passbolt.com website runs behind Cloudflare.

Checked 25 Oct 2026. Hosting can change – report a change.

Passbolt pricing

Passbolt has three self-hosted editions and several cloud plans, all priced per user and in euros (US dollars are also shown):

• Community Edition – free, unlimited users, open source under AGPLv3. Includes password sharing, private and shared folders, users and groups, role-based access, password expiry, 2FA, browser extensions, a CLI and an open API, with community support.
• Pro Edition – €4.50 per user a month, billed yearly, minimum 10 users, volume discounts above 100 users. Adds tags, LDAP provisioning (Active Directory, OpenLDAP), single sign-on with Microsoft, Google and OpenID, account recovery, an activity log, a VM appliance and next-business-day support.
• Enterprise Edition – price on request, with high-availability and disaster-recovery consulting, custom features and a 4-hour support SLA.
• Cloud Business – €5 per user a month billed monthly (10% off when billed yearly), minimum 10 users, with a 7-day free trial.
• Cloud Sovereign – €7 per user a month billed yearly, minimum 10 users, hosted in Luxembourg.

If a Pro subscription expires, your team can keep using the installed version, but without updates or support. There are special plans for non-profits, education and open-source projects. Passbolt has no personal or family plans.

Security and audits

Passbolt is built on OpenPGP. Each user has a private key – generated at sign-up, or your own if you prefer – secrets are encrypted end to end, and the private key is never sent to the server in clear text. Critical operations run in the signed extension, which Passbolt says protects the cryptographic code even if the server is compromised, and users set a personal security token to spot phishing pages. Version 5 added zero-knowledge, encrypted metadata, SCIM and dynamic role-based access.

Passbolt is unusually open about testing. All code, including the paid edition, is open source, and it publishes its audit reports: Cure53 audited the whole security model in 2021 and has since tested SSO, account recovery, the Windows app, cryptography and the encrypted metadata; Quarkslab audited Pro 5.4 in November 2025 to prepare for French ANSSI certification; and a GDPR audit by Examin followed in July 2026. The cloud service is SOC 2 Type II audited, and there is a bug bounty.

What users say about Passbolt

Passbolt has no reviews on Trustpilot yet (checked 25 October 2026). Its main repository on GitHub has 6.2k stars, 407 forks and 347 contributors, which is a better sign of a healthy open-source project than a review score.

Pros and cons

Verdict on Passbolt

Verdict: Passbolt is the most transparent team password manager in Europe: you can read every line of code, read every audit and run the server in your own building, for free. The paid plans add the admin features companies need at a fair price. It is not for private users, and if you want to stay away from US clouds, pick self-hosting or Cloud Sovereign rather than the standard cloud. Best for: IT and DevOps teams that want open source and control over hosting. Not for: individuals and families.

Passbolt is ranked #4 in Best European password managers and in Best European alternatives to LastPass, and #6 in Best European alternatives to 1Password.

Similar European password managers

Passbolt: FAQ