Passbolt

Passbolt is a password manager built for teams rather than individuals, and it is the rare one whose free edition is the self-hosted one. The Community Edition is AGPLv3 and costs nothing at any size: unlimited users, unlimited instances, password and secret sharing, private and shared folders, users and groups, role-based access control, TOTP management, encrypted notes, custom fields, multi-factor authentication, browser extensions and a CLI, an open API, iOS and Android apps, and import and export against kdbx and CSV. Installation is on-premises via a turn-key installer, a Docker container or a VM image.

Pro Edition costs USD 4.9 per user per month billed annually, with a ten-user minimum, and adds tag management, LDAP provisioning against Active Directory or OpenLDAP, single sign-on with Microsoft, Google or OpenID, account recovery, an activity log and next-business-day support. If you would rather not run it, Passbolt Cloud Business is USD 5.4 per user per month on GCP in Belgium and Germany, and an EU Sovereign tier at USD 8 runs in an ISO 27001-certified private data centre in Luxembourg with GDPR, NIS2 and DORA posture. There is no free hosted tier.

The gaps against a consumer-grade vault are real and are on Passbolt’s own public roadmap as backlog items: passkeys as a stored credential type, credit cards, SSH keys and certificates are all unshipped, there is no equivalent of Bitwarden Send, the desktop app is Windows-only, and there is no individual plan at all. What you get instead is a Luxembourg contracting entity, Luxembourg governing law, and the option to keep the whole vault on hardware you control at no licence cost.

Passbolt SA is a Luxembourg société anonyme, trade registry B211048, VAT LU30974424, registered at 9 Avenue du Blues, L-4368 Belvaux. Both binding contracts — the Cloud Customer Terms and the Pro Edition Subscription Terms — name that entity as the contracting party and state at §12.1 that the agreement “shall be governed by, and construed in accordance with, the laws of the Grand Duchy of Luxembourg”, with disputes seated in Luxembourg. Delaware, California, New York and “Inc.” appear nowhere in either document or in the data processing agreement.

The company was founded in 2017 and raised a USD 8M Series A in January 2025 led by Airbridge Equity Partners (Netherlands), with Expon Capital’s Digital Tech Fund, ScaleFund, Seeder, Dedicated, Bondi, Carricha and LBAN alongside — a wholly European cap table. Published customers include Bosch, the French Ministère de l’Intérieur, Luxembourg’s government IT centre CTIE, GLS, Humboldt-Universität and TU Graz. Passbolt holds SOC 2 Type II and is in the French ANSSI CSPN certification process. Luxembourg filed accounts are not publicly free, so headcount and revenue are self-reported rather than register-confirmed.