HashiCorp Vault vs Passbolt (2026): which should you pick?

Pick HashiCorp Vault if

• Fits if you are a platform or security team handing secrets to software
• Works for teams that mix on-premises and cloud and can run their own service

Look elsewhere if

• Not for you if you want browser autofill for personal logins
• Skip it if nobody on your team can run and secure a server
• Watch out: Enterprise features need a licence and no prices could be read
• Too light for phones, as no mobile apps are listed

Pick Passbolt if

• Fits if your team has someone who runs servers and wants open-source code
• Works for data that must stay in the EU, or secrets pulled into pipelines through an API

Look elsewhere if

• Skip it if you're one person, because no paid plan is aimed at individuals
• Pricey if you're a team of three or four, as every paid plan bills for at least 10 users
• Not for you if nobody wants to maintain a server and you won't pay, since free means self-hosted
• Tight if you stay free, as single sign-on, LDAP, account recovery and the activity log are paid
• Watch out: the browser extension is required, the desktop app is Windows only, and offline mode is beta

HashiCorp Vault

• No prices could be read: the vendor's pricing pages sit behind a bot check.
• It is infrastructure software for operators, not a personal password manager with browser autofill.
• Enterprise features need a license; the install docs now call the free edition IBM Vault Community Edition.
• A Community edition is installable on macOS, Windows and Linux, but is run and secured by you.

Passbolt

• Every paid plan has a 10-user minimum, and there is no paid plan aimed at individuals.
• The free Community Edition has to be installed and maintained on your own server and comes with community support only.
• The browser extension is required to use Passbolt, the desktop app is listed for Windows only and offline mode is labeled beta.
• Single sign-on, LDAP provisioning, account recovery and the activity log are not part of the Community Edition.

HashiCorp Vault

Static secrets

Stores and controls access to credentials, tokens and other sensitive data, reachable through a UI, CLI or HTTP API.

Database credentials

A database secrets engine handles the credential lifecycle for database access.

Encryption as a service

Encrypts data in transit and at rest so applications need not hold raw keys or handle encryption themselves.

Certificates and identities

The docs list certificate management and identity and authentication management among the things Vault handles.

Audit logging

Audit logging is part of the platform, supporting the compliance use cases listed in the docs.

Enterprise features

Enterprise adds items such as HSM support, namespaces, Sentinel policies and disaster recovery replication.

Passbolt

Granular credential sharing

Shares passwords, TOTP codes and encrypted notes with individual users and groups, organized in private and shared folders under role-based access control.

End-to-end encryption

Passbolt says secrets are end-to-end encrypted through a public-private key architecture, and it requires its browser extension in order to guarantee that.

Self-hosted or cloud

Install it on your own Linux server with packages, a Docker container or a virtual machine, or use Passbolt Cloud, which the company hosts in the EU.

Open source, paid editions included

The Community, Pro and Enterprise editions are all distributed under AGPLv3, so the entire source code is available to inspect and modify.

API and command line interface

An open API and a CLI let DevOps teams create, retrieve and rotate secrets and inject them into CI/CD pipelines as environment variables.

SSO, directory sync and audit log

Paid editions add single sign-on with Microsoft, Google and OpenID, LDAP and Active Directory provisioning, account recovery and an activity log.

HashiCorp Vault

Pricing could not be confirmed. See developer.hashicorp.com.

Passbolt

• Community Edition$0

  Self-hosted and open source with unlimited users: sharing, private and shared folders, groups, browser extensions, CLI, open API and community support.

• Pro Edition$4.90

  per user / month, billed annually

  Self-hosted, minimum 10 users. Adds LDAP provisioning, single sign-on, account recovery, an activity log, tags and next-business-day support.

• Cloud Business$4.90

  per user / month, billed annually ($5.40 billed monthly)

  Hosted by Passbolt in Belgium and Germany, minimum 10 users, with a yearly database backup and next-business-day email support.

• Cloud Sovereign$8

  per user / month, billed annually

  Hosted in a sovereign private data center in Luxembourg with ISO 27001 certified hosting. Minimum 10 users.

• Enterprise EditionCustom

  Self-hosted, with high-availability and disaster-recovery consulting, custom feature development and a 4-hour support SLA.

• Cloud EnterpriseCustom

  Isolated hosting in Luxembourg with a custom domain, custom backup policies, 24/7 SOC monitoring and a 4-hour support SLA.

HashiCorp Vault

No public discounts listed.

Passbolt

• Annual discount

  10% off Cloud Business with yearly billing

  Cloud Business costs $5.40 per user a month billed monthly or $4.90 billed annually; the pricing page labels yearly billing as 10% off.

• Nonprofit

  Discounts for non-profits and education

  Non-profits, charities, foundations, associations and educational institutions can request a discount on Passbolt Pro or Cloud. The amount is at Passbolt's discretion.

• Other savings

  Discounts for open source projects

  Maintainers and contributors of public open source projects and communities can request a discount through the same form.

• Other savings

  Volume discounts above 100 users

  The Pro Edition pricing notes that volume discounts apply after 100 users, arranged through a quote.