# Passbolt — Password Management

Passbolt by Passbolt SA holds a panel rating of 3/5 from 6 AI judges (category median 2/5), as of 2026-10-14. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Passbolt SA (https://www.passbolt.com)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/password-management/passbolt
- Alternatives: https://whats-best.ai/software/password-management/passbolt/alternatives ([markdown](https://whats-best.ai/software/password-management/passbolt/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-14 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Passbolt SA
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Passbolt is a password manager from Passbolt SA in Luxembourg, offered self-hosted or as a cloud service on Google Cloud Platform databases located in Europe. The bench scores it highest where the evidence is most verifiable: security architecture at 7-8, built on fully open-source code including the commercial edition, OpenPGP client-side encryption and a published Cure53 white-box audit of the SCIM and directory-sync components; and deployment and portability at 7-8, with installation paths from Docker, deb/rpm and Helm to air-gapped self-hosting. Sharing and access control and audit and policy hold steady at 6. The visible splits are identity integration at 4-6, where the divergence turns on the captured pages giving no description of how the vault key is derived or released after single sign-on, and sovereignty at 4-6, where higher scorers credit self-hosting that removes the vendor from the data path while jurisdiction, ownership, data residency and subprocessor exposure are marked unknown. Pricing transparency falls to 1-3 — no public per-user price — though that score is not counted here. Weighted verdicts run from 5.6 to 7.0.

**Speaks for it:**
- Fully open-source code including the commercial edition, with a bug bounty and a published Cure53 white-box penetration test and source-code audit of the SCIM, Azure AD and directory-sync components.
- Deployment paths from Docker, deb/rpm, Helm, a turn-key installer and a VM appliance to air-gapped use, with a documented move from cloud to self-hosted.
- Permissions set at the individual password level, folder trees shareable with a user or a team, and admin-approved account recovery through escrow.
- Cloud databases on Google Cloud Platform located in Europe, with a status page, or a standalone self-hosted server that requires no third-party service by default.
- API, CLI and SDKs for automating retrieval of secrets and machine credentials in CI/CD.

**Held against it:**
- The captured pages give no description of how the vault key is derived or released after a single sign-on.
- No public information on which fields, such as URLs and metadata, stay unencrypted.
- Contracting entity's jurisdiction, ownership, data residency and subprocessor exposure marked unknown on the captured pages.
- No public information on log retention, on offboarding a leaver's shared items, or on emergency access.
- No public price figures, seat minimums, terms or VAT treatment, so an annual invoice cannot be computed from public information.

**Best for:**
- You want to run a password manager inside your own infrastructure, up to air-gapped behind your firewall, and review the source yourself.
- You need per-password sharing across users, groups and whole folder trees, with admin-approved recovery when a user forgets a passphrase.
- You automate secrets for CI/CD and want API, CLI and SDK access.
- You buy on verifiable security evidence: open-source code, a published independent audit and a bug bounty.

**Avoid if:**
- You plan to unlock vaults through single sign-on and need the key-derivation model documented before pointing your directory at the product.
- Your procurement requires a confirmed contracting entity and a published subprocessor list before signature.
- You must build an ISO 27001 or NIS2 evidence file with stated log retention and logging of each view and copy of a shared credential.
- You need published per-user prices to budget before contacting the vendor.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 4/5 | 4/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 |
| Sharing, roles & recovery | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| SSO, directory sync & provisioning | 2/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 |
| Audit logs, policies & reporting | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Hosting choice, offline access & export | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2.5/5 | 3/5 | 2/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3.5/5** | **3/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Anssi cspn process: in_process · ANSSI CSPN [S1]
- Audit reports available: 2026 · 2025 · 2024 · 2023 · 2022 · 2021 [S5]
- Bug bounty: yes [S5]
- Cloud infra report private: Passbolt cloud infrastructure audit (July 2021), report not public, no major issues found [S5]
- Cure53 audit: 2021 · Cure53 [S5]
- Cure53 audit scope: 3 · 5 · 15 [S7]
- Cure53 SCIM audit 2026: white-box penetration test and source-code audit · 2026-02 · SCIM · Azure AD integration · directory synchronisation · Cure53 · 2 [S7]
- Dmarc: yes · yes · yes [S6]
- DPA cloud: cloud customers · yes [S4]
- DPA processors list: yes [S6]
- Encryption: yes [S3]
- Fido alliance: FIDO Alliance [S1]
- GDPR: yes [S1]
- International transfers: Data Privacy Framework or Standard Contractual Clauses · yes [S3]
- ISMS: yes · Passbolt SA [S6]
- Made in europe: yes [S7]
- Open source: yes [S1]
- Pentest annual: at least annually · yes [S6]
- Quarterly access reviews: quarterly [S6]
- Risk assessments annual: at least annual [S6]
- SOC 2: Type II [S1]
- SOC 2 framework: yes [S6]
- SOC 2 type2: 2021 · yes · yes [S5]
- Third party audits: several times a year · yes [S1]
- Third party audits: yes [S5]
- Third party audits: yes [S6]
- Tls in transit: TLS · yes [S6]
- Vendor certifications: ISO27001 · PCI-DSS · SOC 2 [S6]
- Vendor standards: ISO27001 · PCI-DSS · SOC 2 [S3]

**Data**
- Backup retention: 60 [S3]
- Encryption at rest: AES-256 · yes [S6]
- Encryption at rest and transit: yes · yes [S1]
- No sale of personal data: no [S3]
- Payment handling: third-party payment processors via secure iframe · no [S3]
- Portability: paid to free version · cloud to self-hosted [S3]
- Retention deletion: yes · 6 [S6]
- Rights response time: dpo@passbolt.com · 30 to 90 [S3]
- Tenant isolation: yes [S6]

**Hosting**
- Database region: Europe · GCP [S6]
- Deployment: yes · yes [S2]
- Gcp certifications: ISO 27001 · ISO 27017 · ISO 27018 · ISO 27701 · SOC 1 · SOC 2 · SOC 3 · PCI DSS [S6]
- Installation options: Online documentation · Turn-key installer · Docker container · Virtual Machine · yes [S2]
- Made in europe: Europe [S1]
- Made in europe: Made in Europe [S2]
- Made in europe: Made in Europe [S5]
- Offline capable: yes [S5]
- Options: yes · yes · yes [S1]
- Origin: yes [S8]
- Provider: Europe · Google Cloud Platform (GCP) [S6]
- Provider: Google Cloud Platform · Belgium · Germany [S3]
- Self host or cloud: yes · yes [S8]
- Self hosted: yes [S5]
- Waf cdn: caching, WAF, additional firewall · Cloudflare · Aikido [S3]

**Integrations**
- Audit components: SCIM · Azure AD integration · directory synchronisation [S7]
- Import export: kdbx · csv [S2]

**Legal**
- Cloud authorized user terms: yes [S4]
- Cloud customer terms: yes [S4]
- Contributor cla: yes [S4]
- Copyright entity: Passbolt SA [S7]
- DPA terms available: Terms list includes Data Protection Agreement and Cloud customer terms [S6]
- Entity: Passbolt SA [S1]
- Entity: Passbolt SA [S2]
- Entity: Passbolt SA [S5]
- Entity: Passbolt SA [S6]
- Entity: Passbolt SA [S8]
- H2 candidate terms: yes [S4]
- Last update: Date of last update: 14th of July 2026 [S6]
- Legal entity: Passbolt SA [S4]
- Policy last updated: 2026-10-01 [S3]
- Pro subscription agreement: yes [S4]
- Registration jurisdiction: Luxembourg · Luxembourg and EU data protection law [S3]
- Regulatory contact email: security@passbolt.com [S4]
- Regulatory contact languages: English · French [S4]
- Regulatory contact role: single point of contact under Article 11 of the EU Digital Services Act (DSA) [S4]

**Pricing**
- Free tier: yes [S1]
- License: AGPL V3 · yes [S2]
- Nonprofit plans: Plans for NGOs, educational organizations and open source projects [S2]
- Trial: yes [S2]

**Product**
- Account recovery: yes · yes [S1]
- Anti phishing token: Security token displayed at passphrase entry to prevent phishing [S5]
- Audit before stable policy: yes [S7]
- Audit trail export: yes [S1]
- Background checks: yes [S6]
- Backup frequency: yes · yes [S6]
- Bring own key: Users can use their own PGP secret key or have one generated at account creation [S5]
- Browser extensions: Chrome · Brave · Firefox · Vivaldi · Edge · Safari · yes [S8]
- Bruteforce prevention: Each login attempt requires separate challenge; no master password hash [S5]
- Bug bounty: yes [S6]
- Change management: yes · yes [S6]
- Cli: yes [S8]
- Cloud or self hosted: self-hosted · cloud-hosted [S5]
- Community features: Passwords management · TOTP management · Encrypted notes · Custom fields · Granular sharing · Users & groups management · Multi-Factor Authentication · Folders (Private and Shared) · Mobile apps for iOS & Android · Search, filters & favori… [S2]
- Confidentiality agreement: yes [S6]
- Customer count: 50,000+ [S1]
- Desktop apps: yes [S8]
- Devops secret management: yes · yes · yes · yes [S1]
- Disaster recovery tests: yes [S6]
- E2e encrypted passwords: yes [S3]
- E2e encryption: Secret key never sent to server in cleartext [S5]
- Encrypted email notifications: yes [S5]
- Encryption: End-to-end encryption; client-side encryption [S2]
- End to end encryption: yes [S1]
- Enterprise features: High availability consulting · Disaster recovery consulting · White glove migration & hosting · Custom features development · 4 hours SLA phone & email support [S2]
- Export backup recommendation: yes [S6]
- Extension automatic updates: yes [S5]
- Fix versions: PBL-15-001 · 002 · 004 · 005 · 010 · PBL-15-003 · 008 · 009 · 011 · 012 · PBL-15-006 · PBL-15-007 [S7]
- Folder sharing: yes · yes · yes [S1]
- Gpgauth authentication: GpgAuth challenge-based mutual authentication [S5]
- Granular access rights: Permissions set at password level; secrets encrypted per user [S5]
- Hibp check: yes [S5]
- Hosting options: yes · yes [S4]
- Hosting options: yes · yes [S7]
- Ids: yes [S6]
- MFA default: yes · yes [S1]
- MFA options: Yubikey · Duo · TOTP [S5]
- Mobile apps: iOS · Android [S8]
- Native apps: yes · yes [S1]
- No analytics in products or cloud: no [S3]
- No trackers: no · no [S5]
- Offline mode: Beta (Passbolt 5.16) [S1]
- Open source: yes · yes [S5]
- Openpgp crypto: yes · yes [S1]
- Openpgp standard: Based on OpenPGP open standard [S5]
- Owasp guidelines: Code adheres to OWASP guidelines and recommendations [S6]
- Pam: yes · yes · yes [S1]
- Password autofill: browser · desktop app · mobile app · yes · yes · yes [S1]
- Password generator: yes [S5]
- Phishing resistance: yes · yes [S1]
- Pro features: Tags management · Ldap provisioning (AD/OpenLdap) · SSO with Microsoft, Google & OpenID · Account recovery (Escrow) · Activity log (audit changes) · VM appliance · Next business day support [S2]
- Pro full features: Ldap provisioning (AD/OpenLdap) · Account Recovery (Escrow) · SSO with Microsoft · SSO with Google · SSO with OpenID · SSO with AD FS · MFA Policies · Activity log (audit changes) · Action logs as syslogs/log files · Tags · User Passphrase… [S2]
- SCIM opt in default: yes · yes [S7]
- Security training: yes [S6]
- Security whitepaper: yes [S6]
- Self host deploy: yes · yes · yes · yes · yes [S1]
- Self hosting: yes · yes [S6]
- Self hosting: yes [S8]
- Selfhosted SCIM upgrade advice: v5.12+ · upgrade if using SCIM [S7]
- Signed code extension: Critical cryptographic operations done in browser extension [S5]
- Signed secrets: All secrets signed; creator identity cryptographically verifiable [S5]
- SSO 2FA: yes · yes · yes [S6]
- SSO provisioning: yes · yes · yes [S1]
- Standalone no third party: Server is standalone, no third-party service required by default [S5]
- Status page: yes [S6]
- Strong authentication: yes · yes [S3]
- Taxonomy: yes · yes · yes [S1]
- Vulnerability scanning: yes [S6]
- Waf: yes [S6]

**Support**
- Pro SLA: next business day · 4 hours (business hours) [S2]
- Slack: yes [S2]

## Questions

### Is Passbolt European?

Yes. whats-best.ai classifies Passbolt as EU-Made.

### Where does Passbolt store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Passbolt have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Passbolt?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [1Password (3/5)](https://whats-best.ai/software/password-management/1password) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Passbolt alternatives](https://whats-best.ai/software/password-management/passbolt/alternatives).

## What this page leaves out

- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.passbolt.com/ (checked 2026-10-13)
- [S2] Pricing page: https://www.passbolt.com/pricing/pro (checked 2026-10-13)
- [S3] Privacy policy: https://www.passbolt.com/privacy (checked 2026-10-13)
- [S4] Terms of service: https://www.passbolt.com/terms (checked 2026-10-13)
- [S5] Encryption model & independent audits — found from sitemap: https://www.passbolt.com/security (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://www.passbolt.com/security/more (checked 2026-10-13)
- [S7] SSO, directory sync & provisioning — found from sitemap: https://www.passbolt.com/incidents/scim-cure53-security-audit-results (checked 2026-10-13)
- [S8] Hosting choice, offline access & export — found from sitemap: https://www.passbolt.com/downloads (checked 2026-10-13)

---

Cite as: whats-best.ai, "Passbolt — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/passbolt

Corrections: https://whats-best.ai/correct/661?target=page