Tool profile
Passbolt: cost, fit and limits
Passbolt is an open-source credential manager made by Passbolt SA, a Luxembourg company, that stores shared passwords and secrets with client-side end-to-end encryption and exposes them through a browser extension, CLI and open API. It can be self-hosted and is sold in Community, Pro and Enterprise editions.
What to know first
Passbolt began as a team password manager and is used here as a secrets store through its API and CLI. The pricing page lists a free Community edition under AGPLv3, a Pro edition at 4.50 euros per user per month billed annually with a 10-user minimum, and a quoted Enterprise edition. Self-hosting is the default route, with scripts for common Linux distributions, Docker, a VM appliance or source, and a cloud-managed option mentioned without detail.
Passbolt at a glance
| Maker | Passbolt SA, Luxembourg |
|---|---|
| Free plan | Yes |
| Entry price | 4.50 euros per user per month billed annually for Pro |
| API access | Yes |
| Category | Best AI Secrets Management Software in 2026, rank 6 of 10 |
| Website | passbolt.com |
Who Passbolt is best for
European public bodies and NGOs
Passbolt SA is registered in Belvaux, Luxembourg, the software is open source, and the Community edition has no user cap, which fits tight budgets and sovereignty requirements.
IT teams sharing service credentials
Private and shared folders, granular sharing, groups and role-based access let an operations team share a database login without pasting it into chat.
Admins who want LDAP provisioning
Pro adds LDAP provisioning for Active Directory and OpenLDAP, SSO with Microsoft, Google and OpenID, account recovery and an activity log.
Organizations needing regulated support
Enterprise adds high availability consulting, white-glove migration and hosting, custom development and a 4-hour phone and email support SLA. Hosting is part of that offer.
Passbolt plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Community Edition | Free, unlimited users | Open source under AGPLv3 with password and secret sharing, folders, groups, 2FA, browser extensions, CLI, open API, role-based access and community support. |
| Pro Edition | 4.50 euros per user per month billed annually (US$4.90) | Minimum 10 users. Adds tags, LDAP provisioning, SSO, account recovery, an activity log, a VM appliance and next-business-day support. |
| Enterprise Edition | Custom pricing | Adds high availability and disaster recovery consulting, white-glove migration and hosting, custom feature development and a 4-hour support SLA. |
Checked November 2026.
What Passbolt does
- End-to-end encryption
- Secrets are encrypted on the client and decryptable only by authorized users, not by the server. Passbolt avoids the phrase zero-knowledge and describes its approach as end-to-end encryption.
- Open API and CLI
- An open API and a command line tool let scripts and automation read credentials. This makes Passbolt usable for pipelines, although the page does not mention dynamic secrets.
- Granular sharing
- Secrets sit in private or shared folders, with groups and role-based access, search, favorites and secret history, so teams can track who changed a credential.
- Import and export
- Import and export in KDBX and CSV formats ease migration from other managers, and health checks and an offline mode in beta are listed in the comparison table.
- Flexible installation
- Official scripts target Debian, Ubuntu, RedHat and OpenSuse, and Docker, a VM appliance or source installs also exist. A static subscription key enforces the Pro user quota.
How Passbolt handles your data
Passbolt's pricing page states that Passbolt SA is a European company founded in 2016 with its registered address at 9 Avenue du Blues, Belvaux, Luxembourg. It describes protection as client-side end-to-end encryption, where secrets are decryptable only by authorized users rather than the server. With self-hosting, the customer chooses the location and operates the backups. The page mentions a cloud-managed option without details on regions, certifications, retention or AI data use, so the vendor's policy was not checked for those points on the pages read.
Where Passbolt falls short in practice
- Ten-user floor on Pro. Pro requires at least 10 users, so a five-person team that wants LDAP or SSO must pay for ten seats or stay on Community. The restriction applies to the annual contract.
- No rotation or dynamic credentials. The comparison table lists secret history, health checks and expiry policies, not credential rotation engines. Platform teams needing short-lived database users will need another tool.
- Self-hosting is your job. Pro keeps working after a subscription ends but loses updates and support. Backups, upgrades and hardening of the server fall to the customer unless Enterprise hosting is bought.
Works with
Alternatives to Passbolt
Passbolt: common questions
Is Passbolt really free to use?
The Community edition is free forever with unlimited users and is open source under AGPLv3. It includes sharing, folders, groups, 2FA, extensions, the CLI and the open API. Pro, at 4.50 euros per user per month billed annually, adds LDAP, SSO and an activity log.
What happens if our Pro subscription expires?
The pricing page says the instance keeps working if the subscription expires, but you lose updates and support. A static subscription key emailed after purchase enforces the user quota. Upgrading from Community to Pro is supported. Plan renewal before expiry to keep patches flowing.
Does Passbolt use zero-knowledge encryption?
Passbolt avoids the term. The pricing page describes end-to-end encryption in which secrets are encrypted on the client and can be decrypted only by authorized users, not by the server. Ask for the security white paper if your policy specifies a model.
Where is Passbolt based?
Passbolt SA is a European company founded in 2016 with its registered address at 9 Avenue du Blues, L-4368 Belvaux, Luxembourg, according to its pricing page. Self-hosting lets you keep all data in the country of your choice. Self-hosted customers then pick the server location themselves.
How can I install Passbolt Pro?
The page lists official scripts for Debian, Ubuntu, RedHat and OpenSuse, plus Docker, a VM appliance and installation from source. Pro needs a subscription key. A cloud-managed option is mentioned on the page without detail, so ask sales for specifics.