Encryption model & independent audits — found from sitemap — Passbolt

Cited by

Facts read from this source

• E2e encryption Report an error

  “The secret key is never sent to the server in cleartext, and is not sent encrypted without user consent.”

• Bring own key Report an error

  “Users can choose to use their own PGP secret key for full control of their data encryption. Alternatively, the secret key will be generated at the account creation.”

• Openpgp standard Report an error

  “Passbolt is based on OpenPGP, an open and extensible encryption standard which provides confidentiality and integrity, and relies on well known algorithms.”

• Granular access rights Report an error

  “User permissions are set at a password level and secrets are encrypted once for each user that can access it.”

• Signed secrets Report an error

  “All secrets are signed, it is possible to verify cryptographically for each secret the identity of the user that has created it.”

• Self hosted Report an error

  “Passbolt server can be self-hosted inside your own infrastructure: from a raspberry pi inside your office to a High Availability setup hosted at your favorite supplier, you are the one in charge.”

• Standalone no third party Report an error

  “Passbolt server works as a standalone component. It is fully open source and doesn’t require any third party service to be functional by default.”

• Offline capable Report an error

  “Passbolt doesn’t require an internet connection access to be functional. It can be completely isolated, protected by your own firewall rules.”

• No trackers Report an error

  “Our servers do not send usage data or any form of analytics to us.”

• Signed code extension Report an error

  “All critical operations are done by the extension. It is not possible to compromise the security of the cryptographic code if the server is compromised.”

• Extension automatic updates Report an error

  “Passbolt extension updates are rolled out automatically by default, preventing your users from running outdated or unsecure software.”

• Anti phishing token Report an error

  “Passbolt requires your users to set a security token that will be displayed when entering their passphrase. That helps prevent phishing attacks.”

• Gpgauth authentication Report an error

  “Passbolt relies on GpgAuth, an authentication protocol that requires both the server and client to solve a challenge, e.g. produce the proof of the private key ownership.”

• Bruteforce prevention Report an error

  “Each login attempt requires a separate challenge. Unlike other password managers that rely on a master password hash.”

• MFA options Report an error

  “It is possible to add additional factors using Yubikey, Duo, or TOTP.”

• Hibp check Report an error

  “Passbolt protects you from reusing a passphrase that has been used on hacked websites.”

• Password generator Report an error

  “its password generator proposes secure default options with high entropy”

• Third party audits Report an error

  “Passbolt code, client and server is regularly audited by third parties.”

• Cure53 audit Report an error

  “Passbolt security model, front-end code as well as back-end code has been fully audited by Cure53 in 2021.”

• SOC 2 type2 Report an error

  “In 2021 we got successfully audited for SOC 2 Type II. Report is available to customers on demand.”

• Open source Report an error

  “Passbolt is 100% open source, even the commercial version. If you don’t trust the third party audits, you have the freedom to audit it yourself.”

• Bug bounty Report an error

  “We reward security researchers who audit our code and identify vulnerabilities.”

• Audit reports available Report an error

  “Audit reports 2026 2025 2024 2023 2022 2021”

• Cloud infra report private Report an error

  “For security reasons this report is not public. No major issue was found, only hardening suggestions that have been implemented during the course of the summer.”

• Encrypted email notifications Report an error

  “you can configure Passbolt to automatically send you email notifications containing PGP encrypted secrets of the passwords you can access and decrypt them directly from your inbox”

• Entity Report an error

  “Copyright © 2026 Passbolt SA. All rights reserved.”

• Made in europe Report an error

  “Made in Europe. Privacy by default.”

• Cloud or self hosted Report an error

  “Passbolt is versatile and can be self-hosted or cloud-hosted.”

3 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The CISO Encryption model & independent audits
• The CISO Sharing, roles & recovery
• The CISO SSO, directory sync & provisioning
• The CISO Audit logs, policies & reporting
• The CISO Hosting choice, offline access & export
• The CISO European sovereignty
• The Compliance Auditor Encryption model & independent audits
• The Compliance Auditor Sharing, roles & recovery
• The Compliance Auditor SSO, directory sync & provisioning
• The Compliance Auditor Audit logs, policies & reporting
• The Compliance Auditor Hosting choice, offline access & export
• The Compliance Auditor European sovereignty
• The DevOps Engineer Encryption model & independent audits
• The DevOps Engineer Sharing, roles & recovery
• The DevOps Engineer SSO, directory sync & provisioning
• The DevOps Engineer Audit logs, policies & reporting
• The DevOps Engineer Hosting choice, offline access & export
• The DevOps Engineer European sovereignty
• The Identity Engineer Encryption model & independent audits
• The Identity Engineer Sharing, roles & recovery
• The Identity Engineer SSO, directory sync & provisioning
• The Identity Engineer Audit logs, policies & reporting
• The Identity Engineer Hosting choice, offline access & export
• The Identity Engineer European sovereignty
• The Skeptic Encryption model & independent audits
• The Skeptic Sharing, roles & recovery
• The Skeptic SSO, directory sync & provisioning
• The Skeptic Audit logs, policies & reporting
• The Skeptic Hosting choice, offline access & export
• The Skeptic European sovereignty
• The SME Owner Encryption model & independent audits
• The SME Owner Sharing, roles & recovery
• The SME Owner SSO, directory sync & provisioning
• The SME Owner Audit logs, policies & reporting
• The SME Owner European sovereignty