A self-hosted password manager for business: three options and how to choose
Passwords to shared accounts kept in a spreadsheet are one of the most common risks in a small business. A self-hosted password manager can be run in three ways, and for some companies the vendor's cloud service remains the more sensible choice.
In a company, the password to the domain panel, the bank account or the online shop is usually known to several people. It sits in a spreadsheet on a shared drive, in notes or in one computer's browser. When someone leaves, nobody knows which passwords need changing.
A team password manager solves this problem: the password is entered once, and access is given to the people and groups who need it. Many businesses choose the vendor's cloud service. Below we describe the option in which the password vault runs on the business's own server.
When a self-hosted password manager makes sense
For many small companies, the vendor's cloud service is the more sensible choice. The vendor is responsible for availability, updates and backups, and the company pays a subscription. Your own server makes sense when:
- company policy or contracts with clients do not allow passwords to be stored with an outside provider,
- the company already runs its own servers and has someone responsible for them,
- the password manager has to work on a network without internet access.
In each of these cases, the company takes on the responsibility the vendor has in the cloud. The most important parts are the backup and the restore procedure. A password vault that cannot be restored is worse than a spreadsheet.
Passbolt, Vaultwarden and Bitwarden: three ways to run it
Passbolt Community Edition
Passbolt is a password manager designed for teams. The Community Edition is licensed under AGPLv3, and passwords are shared with people and groups.
The vendor keeps some features in the paid Pro edition. According to the price list, these include syncing users from LDAP and Active Directory, SSO sign-in through Microsoft, Google and OpenID, account recovery and an activity log. The lack of account recovery in the free edition needs planning: an employee who loses their key may lose access to their passwords.
Passbolt's trademark policy allows a descriptive wording such as "independent technical support for Passbolt". That is how we describe our service.
Vaultwarden
Vaultwarden is an unofficial server compatible with the Bitwarden apps, developed by the community under AGPLv3. The project's README states plainly that it is not associated with Bitwarden, Inc.
The advantage is compatibility with the Bitwarden client apps for computers, phones and browsers, and low server requirements. The limitation is that the server is maintained by the community, without support from the app's vendor. With data as sensitive as passwords, the business should accept this risk consciously and make sure updates are applied quickly.
The official Bitwarden server
Bitwarden can also be self-hosted in the vendor's version. The Bitwarden documentation says that self-hosting itself is free, but some features are unlocked by a licence file from a paid subscription. The company then buys an organisation plan and installs the server in-house.
The vendor also has a lighter installation option. According to the documentation, it is intended for personal use and home labs. Businesses should use the standard installation.
How to choose a password manager for a team
| Question | What the answer points to |
|---|---|
| Do you need sign-in with a domain account? | In Passbolt this is the Pro edition, with the Bitwarden server a paid plan. The licence cost goes into the comparison. |
| Who is responsible for the server on the vendor's side? | Passbolt and Bitwarden have a vendor. Vaultwarden is developed by the community. |
| Do employees already know the Bitwarden apps? | Vaultwarden and the Bitwarden server use the same client apps. |
| What if someone loses their master password or key? | Account recovery needs to be checked in the chosen edition before deployment. |
There is no single right answer for everyone. We most often choose Passbolt for companies that share passwords in teams and do not need domain sign-in from day one. When domain sign-in is required, we compare the cost of a Passbolt Pro licence and a Bitwarden plan.
What not to forget when deploying a password manager
- Inventory of accounts. A list of shared accounts, their owners and the people who know the passwords today. Without it, the vault quickly drifts away from reality.
- Groups instead of individual shares. Access granted to department groups is easier to withdraw after changes in the team.
- Second sign-in factor. Mandatory for administrators, recommended for users, to the extent the chosen edition allows.
- Off-server backup and a restore test. The keys needed for a restore must not sit on the same server as the backup.
- Removing old spreadsheets. After the passwords are imported, the old files must be deleted, including from the recycle bin and working copies.
- Emergency access. Who gets to critical passwords and how when the server is down. A written procedure, stored outside the vault.
How we deploy a password manager in a business
We deploy password managers on a server that belongs to the client's company, with a backup outside that server and a restore test. Before deployment we show which features are in the free edition and which require a licence bought directly from the vendor. The service description and a comparison with single sign-on for company applications are on the page passwords and sign-in. We describe the licences under which these programs run in our post on open source licences in business, and we write about server backups in the post data backup in the company.
Frequently asked questions
Is a self-hosted password manager more secure than a cloud one?
Not automatically. Security depends on updates, configuration, backups and administrative access. The vendor's cloud service is often more secure for a company that has nobody responsible for a server.
Is Vaultwarden the same as Bitwarden?
No. It is an independent, unofficial server compatible with the Bitwarden apps, not associated with Bitwarden, Inc.
What happens if the password server stops working?
That is why the backup is outside the server and the restore procedure is tested. For critical accounts, emergency access is set up and described in the recovery plan.
Sources
- Passbolt, Pricing (pricing and edition comparison), https://www.passbolt.com/pricing (accessed 02/10/2026)
- Passbolt, Trademark guidelines, https://www.passbolt.com/credits/trademark-guidelines (accessed 02/10/2026)
- Passbolt, Passbolt CE: LICENSE.txt, https://github.com/passbolt/passbolt_api/blob/master/LICENSE.txt (accessed 02/10/2026)
- Vaultwarden, Project repository (README), https://github.com/dani-garcia/vaultwarden (accessed 02/10/2026)
- Bitwarden, Licensing for paid features (self-hosted), https://bitwarden.com/help/licensing-on-premise/ (accessed 02/10/2026)
- Bitwarden, Install and deploy: Lite, https://bitwarden.com/help/install-and-deploy-lite/ (accessed 02/10/2026)
- Bitwarden, Trademark guidelines, https://github.com/bitwarden/server/blob/main/TRADEMARK_GUIDELINES.md (accessed 02/10/2026)
As of 2 October 2026.