Passbolt on a VPS: Open-Source Team Password Manager with GPG Encryption and Audit Logs

By VPS.DO
September 22, 2026

Passbolt is an open-source, team-focused password manager with end-to-end GPG encryption — every password is encrypted with the recipient’s public key, meaning even the server operator cannot read passwords. Unlike Vaultwarden (Bitwarden-compatible, simple teams), Passbolt is built specifically for larger teams needing fine-grained sharing controls, audit trails, LDAP integration, and enterprise security compliance. The Community Edition is free; Passbolt Cloud starts at $49/month for 10 users.

Passbolt vs Vaultwarden: When to Choose Passbolt

Passbolt: GPG end-to-end encryption (server cannot read passwords), mandatory audit trail, LDAP sync, group-based sharing, compliance-ready (SOC2, ISO27001 aligned)
Vaultwarden: Simpler, any Bitwarden client works, personal + team use, less overhead
Choose Passbolt: Regulated industries (finance, healthcare, legal), teams that need audit logs, or when server administrators must not be able to see passwords

Step 1: Docker Compose Setup

<code">mkdir -p /opt/passbolt && cd /opt/passbolt

wget https://download.passbolt.com/ce/docker/docker-compose-ce.yaml \
    -O docker-compose.yml

cp .env.example .env 2>/dev/null || \
    wget https://github.com/passbolt/passbolt_docker/raw/master/.env.example -O .env

nano .env

<code"># Database
DATASOURCES_DEFAULT_HOST=db
DATASOURCES_DEFAULT_USERNAME=passbolt
DATASOURCES_DEFAULT_PASSWORD=StrongPassboltDbPassword!
DATASOURCES_DEFAULT_DATABASE=passbolt

# Server URL
APP_FULL_BASE_URL=https://pass.yourdomain.com

# Email
EMAIL_TRANSPORT_DEFAULT_HOST=smtp.mailgun.org
EMAIL_TRANSPORT_DEFAULT_PORT=587
EMAIL_TRANSPORT_DEFAULT_USERNAME=postmaster@mg.yourdomain.com
EMAIL_TRANSPORT_DEFAULT_PASSWORD=your_smtp_password
EMAIL_TRANSPORT_DEFAULT_TLS=true
EMAIL_DEFAULT_FROM=passbolt@yourdomain.com

# Security
PASSBOLT_GPG_SERVER_KEY_FINGERPRINT=   # Generated in Step 3
PASSBOLT_REGISTRATION_PUBLIC=false      # Invitation-only

<code">chmod 600 .env
docker compose up -d
docker compose logs -f passbolt

Step 2: Nginx Reverse Proxy

<code">sudo nano /etc/nginx/sites-available/passbolt

<code">server {
    listen 80;
    server_name pass.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name pass.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/pass.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/pass.yourdomain.com/privkey.pem;

    # Security headers — important for password manager
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options DENY always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 120s;
    }
}

<code">sudo ln -s /etc/nginx/sites-available/passbolt /etc/nginx/sites-enabled/
sudo certbot --nginx -d pass.yourdomain.com
sudo systemctl reload nginx

Step 3: Create Admin Account and GPG Keys

<code"># Create the first admin user (this generates GPG keys)
docker compose exec passbolt /usr/share/php/passbolt/bin/cake \
    passbolt register_user \
    -u admin@yourdomain.com \
    -f Admin \
    -l User \
    -r admin

# The command outputs a setup URL — open it in browser to complete registration
# You MUST use the Passbolt browser extension for this step
# Extension generates your personal GPG key pair in the browser (never leaves your device)

# Verify GPG fingerprint was set:
docker compose exec passbolt /usr/share/php/passbolt/bin/cake passbolt healthcheck

Step 4: Install Browser Extension

Install “Passbolt” extension from Chrome Web Store or Firefox Add-ons
Open the setup URL from Step 3
Extension generates your personal GPG key pair (private key stays in browser, never on server)
Set a strong passphrase for your GPG key
Complete setup — you can now log in and use Passbolt

Step 5: Create Groups and Share Passwords

<code"># Passbolt web UI workflow:
# 1. Passwords → + → Create password
#    - Name: "Production Database"
#    - Username: postgres
#    - Password: (generates or paste)
#    - URL: postgresql://db.yourdomain.com
#    - Description: Production PostgreSQL root

# 2. Share the password:
#    Right-click password → Share
#    Search users or groups → set permission level:
#    - Can read: view password
#    - Can update: edit password
#    - Owner: full control including sharing

# 3. Create a group:
#    Admin → Groups → + → "Engineering"
#    Add members, set group manager
#    Share passwords with the group instead of individual users

Step 6: LDAP Sync (Pro/Enterprise Feature)

<code"># For Community Edition — create users manually via CLI:
docker compose exec passbolt /usr/share/php/passbolt/bin/cake \
    passbolt register_user \
    -u developer@yourdomain.com \
    -f Jane \
    -l Developer \
    -r user

# For CE with LDAP (community plugin available):
# https://github.com/passbolt/passbolt_ldap_import_plugin_ce

Step 7: Audit Logs

<code"># Passbolt logs every action with user, timestamp, and resource
# Admin → Reports → Action Logs

# CLI access to audit log:
docker compose exec passbolt /usr/share/php/passbolt/bin/cake \
    passbolt audit_log \
    --from "2025-01-01" \
    --to "2025-12-31"

# Key logged events:
# - Password viewed (when and by whom)
# - Password shared or unshared
# - Password created, modified, or deleted
# - User login, failed login, logout
# - MFA events

Backup Strategy

<code"># Passbolt requires backing up:
# 1. Database (contains encrypted passwords)
# 2. Server GPG key (in Docker volume)
# 3. .env file (contains decryption configuration)
# Note: Individual user private GPG keys are in THEIR browser — not on server

docker compose exec db \
    pg_dump -U passbolt passbolt | \
    gzip > /opt/backups/passbolt-db-$(date +%Y%m%d).sql.gz

docker compose exec passbolt \
    cat /etc/passbolt/gpg/serverkey.asc > \
    /opt/backups/passbolt-serverkey-$(date +%Y%m%d).asc

Getting Started

Passbolt with MariaDB uses 300–500 MB RAM. A 2 GB Ubuntu VPS at VPS.DO comfortably runs Passbolt for teams up to 100 users. The GPG encryption model means even if your VPS is compromised and the database is exfiltrated, passwords remain encrypted with individual users’ GPG keys — a significantly stronger security model than AES-256 server-side encryption used by most other password managers.

Conclusion

Passbolt provides team password management with GPG end-to-end encryption, comprehensive audit logs, and invitation-based user management — addressing compliance requirements that simpler tools like Vaultwarden don’t cover. The browser extension handles GPG key generation and decryption entirely client-side, ensuring the server never has access to plaintext passwords. For security-conscious teams and regulated industries, self-hosted Passbolt offers enterprise-grade password governance at open-source cost.

Passbolt on a VPS: Open-Source Team Password Manager with GPG Encryption and Audit Logs