Passbolt team password manager reviewed: AGPL-3.0 Community Edition with OpenPGP encryption

Passbolt SA, a Luxembourg-based company, develops Passbolt as an open-source password manager designed specifically for team credential sharing rather than individual use. The Community Edition is available under AGPL-3.0 on GitHub, encompassing the server, browser extension, mobile applications, and Docker and Helm deployment configurations. The underlying encryption relies on OpenPGP, with each user authenticating via a private key and passphrase, and every authorized recipient receiving a separately encrypted copy of each secret.

The review details a hands-on evaluation of Passbolt Cloud Business, covering the browser extension installation on Vivaldi, entry management for passwords, TOTPs, custom fields, PIN codes, and notes, plus team collaboration features including folder sharing with granular permissions and user role management. The author notes practical friction points: the browser extension requests extensive permissions including read/write access to all website data and download management, and autofill failed when a saved URI did not exactly match the login page domain.

Architecture, licensing, and operational model

• Encryption and authentication: Passbolt uses OpenPGP for encrypting secrets, with users logging in via a private key plus passphrase; each person granted access receives their own individually encrypted copy of the secret.
• Licensing and source availability: The Community Edition, browser extension, mobile apps, and Docker/Helm setups are all published on GitHub under AGPL-3.0; Passbolt states that Pro and Enterprise self-hosted editions also use AGPL-3.0, though no separate repositories exist and Pro requires a subscription key for operation.
• Browser extension permissions: The extension requests broad privileges including reading and modifying all data on all websites, altering clipboard data, and managing downloads, which the reviewer explicitly flagged for user review before installation.
• Entry types and generator: Supported secret types include passwords, TOTPs, custom fields, PIN codes, and notes; the built-in generator allows configurable length, character sets, and passphrase mode.
• Collaboration and access control: Folder-level sharing supports read permissions and user-to-admin promotion; batch operations are available for sharing, exporting, and permanent deletion without recovery.

Why it matters

Passbolt fills a notable gap in the open-source tooling landscape by targeting team credential management rather than individual password storage, an area where proprietary solutions have dominated. For Linux system administrators and DevOps teams, the availability of Docker and Helm configurations under AGPL-3.0 enables self-hosted deployment without user caps, though the subscription-key gating of Pro updates introduces a practical dependency that organizations must evaluate against fully community-governed alternatives.