← Back to all guides
Secure & run · Password manager · ~9 min read

Passbolt

Live

Store and share team passwords safely - end-to-end encrypted, with control over exactly who sees what.

See Passbolt in the tool catalogue →

What is Passbolt?

Passbolt is the team's password manager. Every shared credential - hosting logins, social accounts, supplier portals - lives encrypted in one place, shared with exactly the people who need it. It replaces 1Password or LastPass, and more importantly it replaces passwords pasted into chat and spreadsheets, which is how companies actually get breached.

How it works: Passbolt uses end-to-end encryption (OpenPGP). Your private key + passphrase decrypt secrets in your browser; the server only ever stores encrypted data. Sharing a password means encrypting it for that specific colleague's key. This is also why account recovery is stricter than you may be used to - see the FAQ.

Getting started

  1. Accept your email invitation and follow the setup: your key is generated and you choose a passphrase.
  2. Choose the passphrase well: long, memorable, used nowhere else. Four random words beat "Summer2026!". It protects everything else.
  3. Download the recovery kit when prompted and store it safely (printed in a drawer beats a file on your desktop). It's how you recover access on a new machine.
  4. Install the browser extension (Chrome/Firefox/Edge) - it's the everyday interface: it autofills logins and lets you save new ones on the spot.

Non-negotiable: from today, no password ever goes into chat, email or a spreadsheet. If someone asks for one, share it through Passbolt.

Core concepts

Resources

A stored credential: name, URL, username, password, notes. All encrypted.

Sharing & permissions

Share a resource with a person or group at three levels: can read, can update, owner. Least privilege: give read unless someone needs more.

Groups

Share with "Marketing" instead of five individuals - new team members inherit access, leavers lose it in one step.

Folders

Organise resources (Clients, Infrastructure, Social accounts). Folder sharing cascades to contents.

The password generator

Built into every create dialog. Since Passbolt remembers for you, every password can be long and random - so make every password long and random.

Everyday tasks, step by step

Save and share a new credential

  1. Click + Create (or let the extension offer to save after a login).
  2. Name it clearly ("Acme Ltd - hosting admin"), add URL and username, generate the password.
  3. Select the resource → Share → add the group that needs it, with the lowest sufficient permission.

Use a password (the right way)

  1. Go to the login page; the extension icon appears in the fields.
  2. Click to autofill. Autofill also protects you: it won't fill your credentials into a look-alike phishing domain.
  3. No copy-paste through the clipboard when avoidable.

Offboard a leaver (admin)

  1. Remove them from all groups, then disable the account.
  2. Rotate every password they had access to - this is the step teams skip and regret. Their group memberships tell you the list.

Tips & good habits

  • Turn on multi-factor authentication for your Passbolt account (profile → MFA).
  • One resource per system - don't bundle five logins into one note.
  • Audit quarterly: who has access to what, and does that still match reality?
  • Personal passwords (your own banking etc.) belong in a personal manager, not the company Passbolt.
  • When a supplier emails you credentials, save to Passbolt, then change the password - it travelled in plaintext.

Troubleshooting & FAQ

I forgot my passphrase. Use your recovery kit to restore access on a device. If both passphrase and kit are gone, your account must be re-created and colleagues must re-share resources with you - end-to-end encryption means no one, including admins or Brundo, can reset it for you. This is a feature.

New computer - how do I move? Install the extension, choose "recover an existing account", and use your recovery kit.

Can admins see my passwords? No. Admins manage users and groups; they can only decrypt resources explicitly shared with them.

Is there a mobile app? Yes, mobile apps exist and cover on-the-go lookups. The browser extension remains the primary daily interface.

Useful resources

Curated for the version Brundo hosts (community / self-hosted editions) — cloud-only or enterprise-only material is skipped.

  • User guide — Official guide to everyday use - saving, sharing, groups, the extension.
  • Admin guide — For your workspace admins - users, groups and policies.
  • Community forum — Official forum for the Community Edition we host.
  • GitHub project — Source code and release notes.