Passbolt
The European open-source team vault: Luxembourg company, AGPL code including the paid edition since August 2026, self-hosted for free with unlimited users or cloud-hosted in Belgium and Germany from $5.40 a user, a sovereign Luxembourg tier at $8, four Cure53 audits and a public incident log going back to 2017. Built for organisations only: no personal or family plan, a ten-seat minimum on paid tiers, no pound pricing, no passkeys, and not a single Trustpilot review.
How we testPassbolt SA is a Luxembourg company and the only provider here designed for teams from the first line of code: there is no personal product at all. It encrypts each secret with OpenPGP for every user who may read it, so revoking access removes the ability to decrypt, and authenticates with a challenge-response protocol rather than a password sent to a server. The audit trail is unusually open: Cure53 assessed the security model in 2021, the cryptographic implementation in 2024, encrypted metadata in 2025 and the SCIM and directory-sync layer in 2026 (twelve issues found and fixed), Quarkslab ran a pre-CSPN evaluation for France's ANSSI process, an Examin GDPR audit closed in July 2026, and passbolt.com/incidents lists every disclosed vulnerability and outage since 2017 with severity. From version 5.13 in August 2026 the Pro edition shares one open-source AGPL codebase with the Community edition, so "open source, even the paid version" is now literally true. Self-hosting is the primary model; Passbolt Cloud is the managed option.
Prices in US dollars or euros only on 8 September 2026, with no pound option and no tax statement. Community Edition is free to self-host with unlimited users, and includes shared folders, groups, role-based access, a CLI and the API. Pro Edition, self-hosted, is $4.90 a user a month on annual billing with a ten-user minimum, adding LDAP provisioning, SSO with Microsoft, Google and OpenID, account recovery, activity logs and next-business-day support. Passbolt Cloud Business is $5.40 a user a month billed monthly (about ten per cent off on annual) with a ten-user minimum, hosted in Google Cloud in Belgium and Germany and SOC 2 Type II audited; Cloud Sovereign is $8 a user on annual billing in a private Luxembourg data centre with ISO 27001; Enterprise is custom with a four-hour support SLA in CET business hours. Trials are seven days on Cloud, fees are non-refundable, and price changes come with thirty days' notice.
The product is deliberately narrow. Extensions exist for Firefox, Chrome, Edge and, since June 2026, Safari, with mobile apps for iOS and Android and a Windows app in development; there is no desktop app for macOS or Linux, no passkey support (the PGP key model does not fit WebAuthn), TOTP is stored as a resource type, and no MCP server exists. Developers get a CLI, an open API, a Go SDK and Docker and Helm deployments. Nobody has reviewed Passbolt on Trustpilot, which is a gap in the evidence rather than a verdict. For a technical team in the EU that wants to own its vault and read every line of it, this is the purpose-built choice; a company that wants passkeys, a family plan or pounds should look elsewhere.
Not yet tested by Saaskly: assessed on published pricing, documentation, audit reports and third-party reviews.
Pros
- +EU company, fully open source including the paid edition, self-hosted for free or cloud-hosted in Belgium, Germany or a sovereign Luxembourg centre
- +Four Cure53 audits, a pre-CSPN evaluation, a GDPR audit and a public incident log since 2017; SSO from the Pro tier; CLI, API and Go SDK
- +Per-secret OpenPGP encryption with access revocation built into the crypto
Cons
- −No personal or family plan; ten-seat minimum on every paid tier; dollars or euros only
- −No passkeys, no macOS or Linux desktop app, no MCP server
- −Zero Trustpilot reviews; next-business-day support below Enterprise
Pricing
Minimum commitment: Free (no licence cost). The least you can spend before walking away; excludes numbers, minutes and add-ons.
Community Edition (self-hosted)
$0/mo · no commitment
Same price on any term
- ✓Free, unlimited users, self-hosted: shared folders, groups, RBAC, CLI, API. No personal or family plan exists. Pro Edition self-hosted $4.90/user/mo annual, min 10, adds SSO, LDAP, account recovery, activity log.
Cloud Business
$5.40/mo · month-to-month
$4.86/mo on an annual commitment
Month-to-month costs 11% more
- ✓$5.40/user/mo billed monthly, about 10% less on annual (about $4.86), min 10 users; hosted in Belgium and Germany (GCP), SOC 2 Type II. Cloud Sovereign $8/user/mo annual in Luxembourg, ISO 27001. USD or EUR only, no GBP, tax not stated. 7-day trial; non-refundable.
Specifications
| Rating | 3.1 |
| Business per user* | $4.86/user/mo annual · $5.40 monthly (Cloud Business) |
| Individual | None |
| Free tier | Full-featured |
| Seat minimum | 10 |
| Breach on record | No |
| Last audit | 2026 (Cure53) |
| Open source | Clients + server |
| Self-host | ✓ |
| Passkeys | No |
| TOTP codes | ✓ |
| Hardware key | No |
| SSO | Included |
| SCIM | ✓ |
| Shared vaults | ✓ |
| Secrets manager | No |
| CLI | ✓ |
| MCP server | No |
| Owned in** | EU-owned |
| Data location | Self-hosted; or Belgium and Germany (Cloud Business), Luxembourg (Cloud Sovereign) |
| Family plan | None |
| Scored tier | Cloud Business |
| Tier above | Cloud Sovereign ($8/user) |
| Free tier limits | Community Edition: unlimited users, self-hosting required |
| Money-back (days) | 0 |
| Encryption | OpenPGP per secret per user; GpgAuth challenge-response |
| Zero-knowledge | ✓ |
| Bug bounty | ✓ |
| Email aliases | No |
| Built-in VPN | No |
| Admin console | ✓ |
| Role-based permissions | ✓ |
| Password health reports | No |
| Dark-web monitoring | No |
| External sharing | No |
| Guest accounts | No |
| Emergency access | ✓ |
| Audit logs | ✓ |
| Browser extensions | Firefox, Chrome, Edge, Safari |
| Desktop apps | No |
| Linux | No |
| API | ✓ |
| HQ | Luxembourg |
| Owner | Passbolt SA |
| SOC 2 | ✓ |
| ISO 27001 | ✓ |
| Live chat | No |
| Phone support | No |
| Support channels | Email (next business day), Phone and email with 4-hour SLA (Enterprise), Community forum |
*Business per user: the business or teams tier the score is set on, per user per month on annual billing and then month-to-month, in the currency the vendor shows a UK visitor on the research date; see each profile for the VAT basis, the seat minimum and what the tier above adds.
**Owned in: where the company that owns the provider answers to. A US-owned provider is subject to US law (including the CLOUD Act) wherever the vault is stored; with a zero-knowledge design the vendor cannot read the vault either way, so this column is about the company, not the encryption. "Data location" records where the encrypted vault is stored.
Researched and drafted with AI assistance; reviewed and approved by Tim Meredith. How we use AI
Work at Passbolt? Something not look right? Register in the vendor portal to see what we publish and send corrections.