TeamPass is a self-hosted, GPL-3.0 collaborative password manager written in PHP and backed by MySQL, aimed at individuals, teams and regulated organisations that need folder-level access control, per-user encryption keys and an audit trail while keeping every credential on infrastructure they control.

What it is

TeamPass is an open-source credential vault that a team runs itself. It is a PHP/MySQL application installed on the operator's own server, or run from the teampass/teampass Docker image, and it has been built and maintained since 2009. Secrets are encrypted with AES-256-GCM using random nonces and per-user encryption keys, and access to them is organised through folders and roles rather than through a shared document. Around that core sit LDAP/AD authentication with nested groups, OAuth2 single sign-on, multi-factor authentication, a REST API, a browser extension and an audit trail.

The concrete problem it addresses is credential sprawl inside an organisation: passwords living in chat threads and spreadsheets, with no record of who saw which secret and no way to demonstrate control to an auditor. TeamPass replaces that shared document with folders and roles, keeps a record of who accessed what and when, and provides compliance reports and evidence export so that access controls can be proven rather than merely claimed. It also offers a migration path through import from Bitwarden, LastPass, 1Password and KeePassXC, and it sits in the registry's Business Software / Compliance & Risk Management category.

Key capabilities

• AES-256-GCM encryption of secrets with random nonces and per-user encryption keys, so a personal folder is encrypted with its owner's own key.
• Folder-level access control backed by roles, defining which credentials each user is allowed to see.
• Enterprise authentication through LDAP/AD with nested groups, OAuth2 SSO and multi-factor authentication.
• An audit trail together with access recertification campaigns that record immutable decisions, plus compliance reports and evidence export.
• A REST API and a browser extension for day-to-day autofill.
• Secure Send for sharing credentials with clients and contractors, alongside one-time view, search and export of items.
• Import from Bitwarden, LastPass, 1Password and KeePassXC, with a Docker image published as teampass/teampass.

Who uses it and how

• Individuals and homelab operators run it on a Raspberry Pi or a €5 VPS, keep personal folders under their own encryption key, and pay nothing, with no sign-up required.
• Teams and small businesses use folders and roles in place of a shared document, rely on the record of who accessed what and when, and issue Secure Send links to clients and contractors.
• Enterprises and regulated organisations run access recertification campaigns, export compliance evidence, and connect the vault to LDAP/AD nested groups and OAuth2 SSO while classifying data by ownership.
• Teams arriving from another manager import their existing vault from Bitwarden, LastPass, 1Password or KeePassXC and continue with the browser extension for autofill.

Getting started

Deploy the teampass/teampass image from Docker Hub, or install the PHP 8.2+ application against a MySQL database on a server you control; setup and configuration are documented at documentation.teampass.net.

How it compares

Bitwarden, LastPass, 1Password and KeePassXC appear in the facts only as import sources, so TeamPass is positioned as the place a team consolidates credentials it already holds rather than as a like-for-like hosted service. The contrast the facts do support is one of ownership: TeamPass is GPL-3.0 software running on the operator's own PHP/MySQL server, with no account to create and no company holding the data, whereas the named tools appear here as the sources from which vaults are imported.

When to use it — and when not to

A self-hoster must operate a PHP 8.2+ runtime, a MySQL database, the background tasks and the encryption keys themselves, on a server they patch and back up. Teams that want a hosted service with no server of their own, or that lack the capacity to run a LAMP-style stack, should look elsewhere. The facts show no hosted or managed option for TeamPass, so the deployment burden rests entirely with the adopter.

docker run -d --name teampass \
  -p 8080:80 \
  -v teampass_data:/var/www/html \
  teampass/teampass:latest