KeePass vs Passbolt

KeePass

• Windows users who want a free password manager that needs no account
• People who carry their password database on a USB stick
• Technical users who want to extend a password manager with plugins

Passbolt

• Technical teams that want to self-host an open-source password manager
• Organizations with EU data residency or sovereignty requirements
• DevOps teams that need an API and CLI for secrets in their pipelines

KeePass

• The official program is built for Windows. On Linux and macOS it runs through Mono, and the Android and iOS apps are unofficial contributed ports.
• There is no hosted sync service: you keep copies of the database in step yourself, for example through a cloud-storage folder.
• Extras such as Windows Hello unlock, one-time-password keys and additional ciphers rely on third-party plugins.
• KeePass 1.x is in maintenance only; the site says to use 2.x if in doubt.

Passbolt

• Every paid plan has a 10-user minimum, and there is no paid plan aimed at individuals.
• The free Community Edition has to be installed and maintained on your own server and comes with community support only.
• The browser extension is required to use Passbolt, the desktop app is listed for Windows only and offline mode is labeled beta.
• Single sign-on, LDAP provisioning, account recovery and the activity log are not part of the Community Edition.

KeePass

Encrypted database file

All entries live in one database file encrypted with AES-256 or ChaCha20. The complete database is encrypted, including user names and notes, not only the passwords.

Master password, key file or both

A database opens with a master password, a key file or the two combined. KeePass 2.x can also lock a database to the current Windows user account.

Auto-Type

Types an entry's details into dialogs and web forms with a customizable sequence, and a global hot key finds the matching entry while KeePass runs in the background.

Portable

Runs from a USB stick without being installed, creates no registry keys and keeps its settings inside its own directory.

Plugins

A plugin architecture lets other developers add functions such as extra import and export formats, more encryption algorithms and additional key sources.

Synchronization and import

KeePass 2.x merges changes made in several copies of a database, including files reached over FTP, HTTP or WebDAV, and imports more than 35 formats out of the box.

Passbolt

Granular credential sharing

Shares passwords, TOTP codes and encrypted notes with individual users and groups, organized in private and shared folders under role-based access control.

End-to-end encryption

Passbolt says secrets are end-to-end encrypted through a public-private key architecture, and it requires its browser extension in order to guarantee that.

Self-hosted or cloud

Install it on your own Linux server with packages, a Docker container or a virtual machine, or use Passbolt Cloud, which the company hosts in the EU.

Open source, paid editions included

The Community, Pro and Enterprise editions are all distributed under AGPLv3, so the entire source code is available to inspect and modify.

API and command line interface

An open API and a CLI let DevOps teams create, retrieve and rotate secrets and inject them into CI/CD pipelines as environment variables.

SSO, directory sync and audit log

Paid editions add single sign-on with Microsoft, Google and OpenID, LDAP and Active Directory provisioning, account recovery and an activity log.

KeePass

• Free$0

  Both editions, KeePass 1.x and 2.x, as an installer or a portable ZIP package, with the full source code.

Passbolt

• Community Edition$0

  Self-hosted and open source with unlimited users: sharing, private and shared folders, groups, browser extensions, CLI, open API and community support.

• Pro Edition$4.90

  per user / month, billed annually

  Self-hosted, minimum 10 users. Adds LDAP provisioning, single sign-on, account recovery, an activity log, tags and next-business-day support.

• Cloud Business$4.90

  per user / month, billed annually ($5.40 billed monthly)

  Hosted by Passbolt in Belgium and Germany, minimum 10 users, with a yearly database backup and next-business-day email support.

• Cloud Sovereign$8

  per user / month, billed annually

  Hosted in a sovereign private data center in Luxembourg with ISO 27001 certified hosting. Minimum 10 users.

• Enterprise EditionCustom

  Self-hosted, with high-availability and disaster-recovery consulting, custom feature development and a 4-hour support SLA.

• Cloud EnterpriseCustom

  Isolated hosting in Luxembourg with a custom domain, custom backup policies, 24/7 SOC monitoring and a 4-hour support SLA.

KeePass

No public discounts listed.

Passbolt

• Annual discount

  10% off Cloud Business with yearly billing

  Cloud Business costs $5.40 per user a month billed monthly or $4.90 billed annually; the pricing page labels yearly billing as 10% off.

• Nonprofit

  Discounts for non-profits and education

  Non-profits, charities, foundations, associations and educational institutions can request a discount on Passbolt Pro or Cloud. The amount is at Passbolt's discretion.

• Other savings

  Discounts for open source projects

  Maintainers and contributors of public open source projects and communities can request a discount through the same form.

• Other savings

  Volume discounts above 100 users

  The Pro Edition pricing notes that volume discounts apply after 100 users, arranged through a quote.