Passbolt is a security-first, open source password manager for teams, published here as the Passbolt Community Edition (CE) JSON API under the AGPL-3.0 licence and built for organizations that need to centralize, organize and share passwords and secrets on infrastructure they control.

What it is

This repository is the server-side API for Passbolt Community Edition, written in PHP on the CakePHP 5 framework. It is not the end-user application; it is the backend that the Passbolt browser extension, mobile apps, command-line client and desktop app talk to over a JSON API. The project describes itself as a security-first, open source password manager for teams, and its stated purpose is to let an organization centralize, organize and share passwords and secrets securely rather than leaving them scattered across individual vaults and ad-hoc channels.

The concrete problem it solves is shared credential management inside a team. Passbolt gives every user their own secret key and keeps credentials end-to-end encrypted, so the server holds encrypted material rather than plaintext secrets, and administrators can apply sharing and access policies across the organization. Access to credentials is granted and audited centrally instead of being negotiated informally between colleagues. Passbolt is headquartered in the EU, specifically in Luxembourg, and states that it does not collect personal data or telemetry, which allows it to be deployed in an air-gapped environment where no outbound connection is permitted.

Key capabilities

• End-to-end encryption with user-owned secret keys, so the server never needs plaintext credentials.
• Audited multiple times annually, with the findings of those reviews made public.
• No personal data or telemetry collection, and support for air-gapped deployment.
• Deployment options covering Docker, Kubernetes and native packages for Ubuntu, Debian, RedHat, Fedora, CentOS, RockyLinux, AlmaLinux, Oracle Linux, openSUSE and Raspberry Pi, plus AWS and DigitalOcean.
• Client coverage across browser extensions (Chrome listed in the README), mobile apps, a CLI and a desktop app.
• Collaboration features for sharing and auditing credentials, including policies aimed at power users.
• A PHP/CakePHP 5 codebase held to PHPStan level 6 and Psalm level 4.

Who uses it and how

• Teams that must share credentials across members and want a central, auditable store instead of individual password files.
• Organizations in regulated or sensitive environments that need an air-gapped installation with no telemetry leaving the network.
• European organizations that prefer a vendor headquartered in Luxembourg and data kept under their own control.
• Operations and platform teams that deploy the API through Docker or Kubernetes and distribute the browser extension to staff.
• Users who need the same credential store from a browser, a phone, a CLI or a desktop application.

Getting started

Installation is documented per platform, with options for Docker, Kubernetes and native packages for Ubuntu, Debian, RedHat, Fedora, CentOS, RockyLinux, AlmaLinux, Oracle Linux, openSUSE, Raspberry Pi, AWS and DigitalOcean, all linked from https://passbolt.com/ce/docker and the sibling passbolt.com/ce/* pages. Server documentation and the project homepage are at https://passbolt.com.

How it compares

No comparable or competing tools are named in the facts provided for this entry, so this project stands alone in this registry. The distinguishing facts that are available are its AGPL-3.0 licence, its self-hostable deployment model across Docker, Kubernetes and native packages, and its stated position that user-owned secret keys and end-to-end encryption keep plaintext credentials off the server.

When to use it — and when not to

Choose Passbolt when the goal is a self-hosted, end-to-end encrypted credential store for a team that is willing to run and maintain the API itself and to roll out a client to every user. It is a poor fit for someone who wants a purely client-side personal password manager, or for a team without the appetite to operate and upgrade a PHP/CakePHP server. The honest caveat is that this repository is the API rather than a complete product, and the README is largely a set of installation links, so anyone evaluating it should expect to read the separate documentation for the deployment details.