Passbolt is an open-source password manager built for teams. Each user has their own OpenPGP key pair; passwords are encrypted in the browser for each person they’re shared with, so the server only stores encrypted data. You get folders, groups, sharing permissions, an audit trail of who accessed what (in some editions), browser extensions and mobile apps.

This guide installs the free Community Edition (CE) on a VPS.

Requirements

  • A VPS with Docker (2 GB RAM recommended).
  • A domain, e.g. pass.example.com, with HTTPS — browsers and the extension require it.
  • Working email (SMTP) — Passbolt sends account setup and recovery links by email.

1. Docker Compose

mkdir -p /srv/passbolt && cd /srv/passbolt

compose.yaml:

services:
  db:
    image: mariadb:11
    restart: unless-stopped
    environment:
      MYSQL_RANDOM_ROOT_PASSWORD: "true"
      MYSQL_DATABASE: passbolt
      MYSQL_USER: passbolt
      MYSQL_PASSWORD: ${DB_PASSWORD}
    volumes:
      - db:/var/lib/mysql

  passbolt:
    image: passbolt/passbolt:latest-ce
    restart: unless-stopped
    depends_on: [db]
    environment:
      APP_FULL_BASE_URL: https://pass.example.com
      DATASOURCES_DEFAULT_HOST: db
      DATASOURCES_DEFAULT_USERNAME: passbolt
      DATASOURCES_DEFAULT_PASSWORD: ${DB_PASSWORD}
      DATASOURCES_DEFAULT_DATABASE: passbolt
      EMAIL_DEFAULT_FROM: [email protected]
      EMAIL_TRANSPORT_DEFAULT_HOST: smtp.example.com
      EMAIL_TRANSPORT_DEFAULT_PORT: 587
      EMAIL_TRANSPORT_DEFAULT_USERNAME: [email protected]
      EMAIL_TRANSPORT_DEFAULT_PASSWORD: ${SMTP_PASSWORD}
      EMAIL_TRANSPORT_DEFAULT_TLS: "true"
    volumes:
      - gpg:/etc/passbolt/gpg
      - jwt:/etc/passbolt/jwt
    command: ["/usr/bin/wait-for.sh", "-t", "0", "db:3306", "--", "/docker-entrypoint.sh"]
    ports:
      - "127.0.0.1:8080:80"

volumes:
  db:
  gpg:
  jwt:

.env with random DB_PASSWORD and your SMTP_PASSWORD (chmod 600 .env), then:

docker compose up -d
docker compose logs -f passbolt

Compare with Passbolt’s current official Compose file in case variables have changed.

2. HTTPS

Proxy pass.example.com to 127.0.0.1:8080 with Nginx and a Let’s Encrypt certificate — see Nginx reverse proxy for Docker containers. Make sure X-Forwarded-Proto is passed.

3. Email

Passbolt depends on email. Use a transactional email provider, or your own server. Sending directly from a VPS requires open outbound mail ports and rDNS — available on our USA VPS (see Email VPS); on Hong Kong and Japan plans mail ports are blocked, so use an external SMTP service there.

Check the health of the installation:

docker compose exec passbolt su -m -c "/usr/share/php/passbolt/bin/cake passbolt healthcheck" -s /bin/sh www-data

4. Create the first admin

docker compose exec passbolt su -m -c "/usr/share/php/passbolt/bin/cake passbolt register_user \
  -u [email protected] -f First -l Last -r admin" -s /bin/sh www-data

Open the link it prints (or receives by email), install the browser extension, create your passphrase and download your recovery kit (your private key). Store it safely — without the key and passphrase, your passwords can’t be decrypted.

5. Use it with your team

  • Invite users from the admin panel; each sets up their own key.
  • Create groups (e.g. devops, marketing) and share passwords or folders with groups.
  • Permissions: read, update, owner.
  • Use the browser extension to fill logins, and the mobile apps for phones.
  • Consider enabling account recovery and MFA options available in your edition.

6. Back up the right things

You need both the database and the server’s keys:

# database
docker compose exec -T db sh -c 'mariadb-dump -u passbolt -p"$MYSQL_PASSWORD" passbolt' > passbolt-$(date +%F).sql
# server GPG keys
docker compose cp passbolt:/etc/passbolt/gpg ./gpg-backup

Store backups encrypted and off-server (automated VPS backups). Users must keep their own recovery kits.

7. Updates

docker compose pull && docker compose up -d

Passbolt runs migrations on start. Back up first.

Sizing

Passbolt and MariaDB run comfortably on a 2 GB Docker VPS. Pair it with Authentik for single sign-on to your other tools.

  • Security
  • Passwords
  • Docker