How to Use Passbolt: A Beginner's Guide to Team Password Sharing

CodexFuse Team · 2026-11-01T16:58:00.000Z · 15 min read

Learning how to use Passbolt takes one focused session, and by the end your team will stop sharing passwords in chat messages — because every credential will live in an end-to-end-encrypted vault where nobody, not even the server admin, can read it. This passbolt tutorial is the missing beginner arc: the GPG mental-model lesson that makes everything else click, the invitation-to-first-login setup in five steps, the recovery-kit rule that can never be broken, folders and groups for team sharing, the autofill habit for daily use, and the self-hosted path for teams that want to own their data. One lane line first, and I will not blur it: Bitwarden is the personal lane — one master password for your own vault — and our Bitwarden beginner guide covers that world. Passbolt is the team lane: every teammate holds their own GPG keypair, and sharing credentials between people is the core feature, not an afterthought. And before you type anything, generate the passphrase properly with our passphrase generator — because the passphrase you pick locks your private key.

What Is Passbolt, Exactly?

Passbolt is an open-source, end-to-end-encrypted password manager built for teams. The Community Edition is free for unlimited users under the AGPLv3 license, and it treats shared credentials as a first-class concept: passwords, API keys, server logins, and Wi-Fi codes live in folders that are owned by people, shared with groups, and re-encrypted for every person who is allowed to open them. Instead of one master password unlocking one vault, every user generates their own OpenPGP keypair during setup. Your passphrase unlocks your private key — it is not itself the encryption key — and the server stores only ciphertext. Logins use GPGAuth, a challenge-response protocol where both sides prove they hold their keys without ever transmitting a secret. The result is a vault where the hosting provider and the Passbolt admin can never decrypt your passwords, which is exactly the property a team vault needs.

How Do You Set Up Passbolt for the First Time?

The whole setup is five steps, and the vendor's quick-start guide walks them in this order. If you are joining a team, your admin starts the arc by sending you an invitation email.

1. Accept the invitation and install the Passbolt browser extension — it exists for Chrome, Firefox, Edge, and Safari — and pin the add-on to your toolbar so the icon is always one click away.
2. Choose your passphrase. This is the one that locks your private encryption key, so make it long and genuinely memorable rather than clever and forgettable.
3. Download the account recovery kit the moment the setup offers it. This file is your private PGP key; without it, your account is unrecoverable in the Community Edition.
4. Pick a color and a three-character security token. This token appears on every passphrase prompt, and it is your anti-phishing check: if the token does not match the one you chose, the prompt is not coming from your real extension.
5. Open your first shared folder, find the credentials your admin already shared with you, and save one password of your own to prove the arc is complete.

The mental model to lock in: your passphrase protects a key, not a vault. Bitwarden derives your vault's encryption from your master password; Passbolt hands you a real OpenPGP keypair, and your passphrase merely unlocks the private half. Lose the passphrase and you cannot open your key; lose the recovery kit and there is no second key to fall back on. That distinction runs the rest of this guide.

The Recovery Kit: The One Rule That Can Never Be Broken

The recovery kit is the spine of this guide, so here it is loudly and exactly once: if you lose both the recovery kit and the browser profile that holds your key, nobody on earth can decrypt your passwords — not the Passbolt admin, not the server owner, not Passbolt the company. The keys never leave your device, which is the feature, and there is no reset password email that undoes physics. In the Community Edition the account has to be deleted and re-created, and anything in your private folders is gone forever, because nobody else's key could ever open them. Pro and Cloud customers get admin-assisted account recovery through an organization recovery key, a feature that only exists outside the Community Edition. So treat the kit like a physical key: download it, store it somewhere the passphrase is not, and test that you can actually use it before you need it. Your passphrase protects a key, the kit IS the key, and that is the only backdoor you will ever have — the one you control.

While you are here, two habits make this rule painless. First, make the passphrase long enough that you will never forget it; our password length guide explains why length beats complexity, and our passphrase generator builds one in seconds. Second, keep the kit offline or in a second location — a USB drive, a printed copy in a drawer, an offline backup disk — anywhere except the same machine whose browser profile you might one day lose.

How Do You Use Passbolt Day to Day?

Daily life in Passbolt happens in the browser extension. Click the pinned icon and the quick-access panel opens your vault without a full page load; click the icon inside a login form and the extension offers autofill or auto-suggest for that site, plus one-click password generation when you are creating an account. The in-form menu is the habit to build: rather than opening the vault, copying a password, and pasting it — leaving secrets in your clipboard for minutes — you fill directly from the form. That is also the moment to save the credential if it is new: the extension notices a login it has never seen and offers to store it.

On the road, the native mobile apps for iOS and Android open the same vault with biometric unlock, and a Windows desktop app covers the laptop case. Passbolt has also been extending an Offline Mode through its 5.16 and 5.17 releases, so cached credentials stay reachable when the network does not. None of this replaces the browser extension for a team user — it is the daily driver — but the pattern is the same everywhere: your key decrypts locally, the server never sees plaintext.

How Do Folders Work?

Folders are how teams stay sane. Every resource in Passbolt lives inside a folder, and folders come in two flavors: private folders, which only you can open, and shared folders, which belong to a defined set of people. Permissions are set at the folder level and inherited by everything inside it, which means one decision at the folder level covers dozens of passwords at once. The working pattern for a small team is one shared folder per unit of trust: an engineering folder, a finance folder, a client-projects folder, a wifi-and-building-access folder. New hires get added to folders instead of being sent a hundred individual shares, and leavers get removed once, from the folder, instead of a hundred times. If two different teams should never see each other's credentials, they live in two different folders, and that single rule does more for access hygiene than any policy document. When a whole team needs a folder at once, passbolt groups are the scalable way to grant it — one share to the group instead of one share per person, as the next section explains.

How Do You Share Passwords with Your Team?

Sharing is Passbolt's home field, and it runs on a small, exact permission model. Learn these three levels once, because everything about groups and folders hangs off them.

Two rules ride with the table. Every resource must keep at least one owner — Passbolt will not let the last owner walk away, which prevents orphaned credentials that nobody can share. And shares are per-recipient encryption: when you share a secret with five people, the server stores five separately encrypted copies, one under each person's public key, which is why sharing does not dilute the end-to-end promise.

Groups are how you share at scale. Create a group, put the team in it, share the folder with the group, and membership drives access both ways: join the group and the credentials open; leave and access is revoked. There is one mechanical detail worth knowing, because it surprises admins: when a new member joins a group that has shared passwords, the group manager's browser re-encrypts each shared secret for the newcomer's public key. That is why only a group manager — never a plain admin — can add members to a password-sharing group: the cryptography happens in the manager's browser, not on the server. Only admins can create groups, rename them, delete them, or remove members, and directory syncs via LDAP deliberately do not auto-add members to password-sharing groups; the sync notifies the group managers instead, so a directory change cannot silently hand someone the keys.

How Do You Self-Host Passbolt with Docker?

This guide is usage, so the deploy gets one section and no more. The official passbolt docker path pairs the passbolt/passbolt:latest-ce image with MariaDB 10.11, and it is the path the maintainers document. Set APP_FULL_BASE_URL to your real domain — the template defaults to https://passbolt.local with a self-signed certificate, which is fine for a first boot and never acceptable for real users — keep the GPG keys, JWT keys, and database in persistent volumes so upgrades do not eat your identity material, and give the container a working SMTP server, because invitations and recovery emails are queued and sent by a cron running inside it. Two infrastructure details bite first-timers: keep NTP healthy on the host, because clock drift causes GPG authentication failures, and serve HTTPS from day one — the template serves HTTPS by default, and the community deploy guides put Let's Encrypt in front. Once the stack is up, the first admin is created from the shell with the cake passbolt register_user command, which prints a one-time registration URL instead of a default password. That is the complete picture of passbolt self-hosted on Docker: compose file, real domain, HTTPS, SMTP, and one admin URL. New to the tool? Start with our Docker beginner guide before you touch Compose.

Passbolt vs Bitwarden: Which One Should You Use?

The lane line from the intro stands: Bitwarden is the personal lane and Passbolt is the team lane. Here is the same decision as a comparison, covering the "passbolt vs bitwarden" cluster members on this one page rather than splitting them.

For a small business onboarding its first shared vault, the honest answer is Passbolt when the passwords are shared by design — dev credentials, client logins, shared inboxes, Wi-Fi — and Bitwarden when everyone mostly needs their own vault with a few shared items. The tools overlap; the lanes do not.

How Much Does Passbolt Cost?

The Community Edition costs nothing, forever, for unlimited users — open source under AGPLv3, self-hosted on your own server, which makes it the free passbolt for teams that want to own their infrastructure. When a team outgrows CE, Pro is self-hosted at €4.50 per user per month billed annually, with a ten-user minimum and volume discounts past a hundred users. The managed route is Passbolt Cloud: Business at $5.40 per user per month with a ten-user minimum, hosted in Belgium or Germany, and Sovereign at $8 per user per month hosted in Luxembourg, with Enterprise on custom quote. All of these figures were verified on passbolt.com on November 1, 2026 — pricing moves, so confirm the current page before you budget.

7 Beginner Mistakes to Avoid

Sources

Every fact in this guide was verified against live sources on November 1, 2026: the official Passbolt user quick-start guide PDF (the five-step first-login arc — invitation, extension pinned to the toolbar, passphrase, recovery-kit download, color and three-character security token; GPGAuth challenge-response; per-recipient encryption), the Passbolt admin-assisted account recovery documentation (org recovery key for Pro and Cloud only, Community Edition accounts must be re-created), the Passbolt CE-to-Pro page (Community Edition free, unlimited users, AGPLv3; Pro €4.50 per user per month billed annually, ten-user minimum, volume discounts past one hundred users), the Passbolt Cloud pricing page (Business $5.40 per user per month, ten-user minimum, hosted in Belgium and Germany; Sovereign $8 per user per month, Luxembourg; Enterprise custom quote), the Passbolt changelog (Community Edition 5.17.1 released October 26, 2026; 5.17.0 October 20, 2026 with passkey MFA; 5.16.2 October 12, 2026 with Edge Manifest V3; 5.16.0 September 17, 2026 with Offline Mode beta; Safari GA in 5.12.0, May 12, 2026), the official Compose file at download.passbolt.com (passbolt/passbolt latest-ce plus MariaDB 10.11; APP_FULL_BASE_URL defaulting to https://passbolt.local; persistent GPG, JWT, and database volumes; SMTP and NTP requirements), the official group-management and resource-sharing documentation (three permission levels, the one-owner minimum, group managers re-encrypting for new members, admins-only group creation, directory sync notifications), the passwork.pro encryption-boundary comparison (Passbolt's passphrase unlocks the private key versus Bitwarden's master-password key derivation), and the computingforgeeks.com Passbolt 5.17 Docker guide tested in October 2026 (the lost-kit-plus-profile unrecoverability rule and the Let's Encrypt fronting pattern).

Frequently Asked Questions

Is Passbolt really free for teams?

Yes. The Community Edition is free for unlimited users under the AGPLv3 license, self-hosted on your own server. You pay only when you want Pro features on a self-hosted install (€4.50 per user per month, billed annually) or the managed Cloud editions.

What happens if I lose my Passbolt recovery kit?

If you still have your passphrase and your browser profile, you can export a fresh kit from the extension — the kit is just your private key in file form. If you lose the kit and the browser profile together, the Community Edition account is unrecoverable and must be deleted and re-created; anything in private folders is lost. Pro and Cloud customers can use admin-assisted recovery through an organization recovery key.

Can the Passbolt admin read my passwords?

No. Every secret is encrypted for the public keys of the people it is shared with, and the admin's key is not one of them unless someone explicitly shares with them. The server stores ciphertext only; decryption happens in your browser with your private key.

Does Passbolt work on my phone?

Yes. Native mobile apps for iOS and Android open the same vault with biometric unlock, and there is a Windows desktop app as well. The browser extension — Chrome, Firefox, Edge, or Safari — remains the daily driver for team users because autofill lives there.

Passbolt or Bitwarden for a small business?

Use Passbolt when passwords are shared by design — dev credentials, client logins, shared inboxes — because its whole model is built around teams, groups, and folders. Use Bitwarden when everyone mostly needs a personal vault with a few shared items. The personal and team lanes are different, and this guide keeps that line sharp.

One focused session is all it takes: install the extension, choose a passphrase you will never forget, guard the recovery kit like a physical key, and put every shared credential in a folder your team owns. Teams that do that stop sending passwords in chat forever.