Self-Hosted Password Manager for Business: Vaultwarden, Bitwarden and Passbolt Compared

Do you want to run a password manager in your company yourself and check whether Vaultwarden, Bitwarden or Passbolt fits? We install, host and operate Vaultwarden and Passbolt and set up Bitwarden on your infrastructure. Vaultwarden is also part of the Secure Access and Identity package. View Vaultwarden operations · Book an intro call (free and non-binding)

Vaultwarden, Bitwarden and Passbolt can be run on your own infrastructure and manage credentials for teams. They differ in licence, edition limits (SSO, SCIM, directory integration), operating model, vendor support and reviews. This comparison sets the differences side by side with primary sources and licence quotations. Where the sources do not support a statement, the text says "not found". As of: 10 November 2026.

Table of contents

• In brief
• How do Vaultwarden, Bitwarden and Passbolt differ at a glance?
• Which licence applies, and what costs money?
• Which features are in which edition?
• Who is behind each project?
• Which versions apply in November 2026?
• How much server does each password manager need?
• How secure is operation?
• What do the BSI and NIS2 say about password managers?
• Which common misconceptions are there?
• When does which option fit?
• Status and methodology
• Our approach at WZ-IT
• Further guides
• Sources

In brief

The assignment is our assessment based on the differences documented below, not a vendor statement.

How do Vaultwarden, Bitwarden and Passbolt differ at a glance?

Other password managers for businesses, for example Psono, Passwork or Password Depot, are not part of this comparison and were not examined.

Which licence applies, and what costs money?

On the Bitwarden licence structure: the LICENSE.txt reads "Source code in this repository is covered by one of two licenses: (i) the GNU Affero General Public License (AGPL) v3.0 (ii) the Bitwarden License v1.0. The default license throughout the repository is AGPL v3.0 unless the header specifies another license. Bitwarden Licensed code is found only in the /bitwarden_license directory." Among other things, the modules Scim and Sso sit in that directory. In section 2.1, the Bitwarden License grants a licence "for the sole purposes of internal development and internal testing, and only in a non-production environment". The LICENSE_FAQ adds that production use requires "a paid subscription" and that the Bitwarden License does not qualify as an open-source licence under the OSI definition. The same document states that the Api module includes Commercial.Core under the Bitwarden License by default, but that this can be disabled with /p:DefineConstants="OSS" when building. This is not legal advice.

On the AGPL, which all three server cores use: the preamble describes it as "a free, copyleft license for software and other kinds of works, specifically designed to ensure cooperation with the community in the case of network server software". Under section 13, anyone who modifies the program must offer all users interacting with it remotely through a computer network access to the Corresponding Source of the modified version. By its wording, running the server unmodified does not trigger this duty ("if you modify the Program"). That is not a complete clearance for operation: further AGPL duties apply when the software is distributed, and anyone wanting to offer Bitwarden as a service will find separate notes on service offerings in the LICENSE_FAQ. This is not legal advice. For Passbolt there is a trademark reservation: the README calls "Passbolt" a registered trademark of Passbolt SA and declines a trademark licence under AGPL section 7(e).

On Vaultwarden, the wiki says: "Vaultwarden supports some paid features and offers that functionality for free."

What do the plans cost?

All amounts come from the vendor pages, retrieved on 10 November 2026.

Our own calculation for 100 users with annual billing, without discounts and without operating costs:

The currencies are not converted. Server, operation, backups and updates come on top if you run it yourself.

Which features are in which edition?

The tables reproduce vendor statements. "Not found" means we did not find the feature in the documentation named, not that it is certainly missing.

Identity and provisioning

Operation and support

Who is behind each project?

Vaultwarden. A community project. According to the README, it is not associated with Bitwarden, but one active maintainer is employed by Bitwarden and contributes in their own time. We did not find a company or a commercial support offering.

Bitwarden. Bitwarden, Inc. develops server and clients and offers a cloud (according to its own statement on Microsoft Azure, regions US and EU) and the self-hosted edition. The LICENSE.txt excludes rights in trademarks and logos.

Passbolt. Passbolt SA owns the trademark; according to the README, the company is headquartered in the EU, specifically in Luxembourg and collects no telemetry according to its own statement.

Which versions apply in November 2026?

How much server does each password manager need?

Sources: Vaultwarden wiki and README, Bitwarden Linux installation and Lite installation, Passbolt requirements and composer.json. The values have different reference points (minimum, recommendation, side note) and are not a capacity comparison under equal load. For Lite the database is not supplied; according to Bitwarden, maintenance and backups are entirely the operator's responsibility.

How secure is operation?

Which external reviews exist?

The BSI result applies to version 1.30.3. We did not check whether the points named then still hold in the current version. Among other things, the report states that Vaultwarden provides no offboarding process for organisation members in which the organisation keys are replaced. Penetration tests and code audits examine a product at a point in time, while SOC reports and ISO 27001 concern an organisation or a service; none of them is a certificate for your own instance. The pages do not state the scope of the Bitwarden and Passbolt evidence for a self-operated instance.

Which security reports were there in 2026?

The numbers are not comparable and do not form a security ranking. Vaultwarden publishes vulnerabilities as GitHub advisories, while Bitwarden and Passbolt handle reports through other processes. A higher number therefore does not mean a product is less secure.

The entries belong to different classes of flaw (access control in organisations, SSO flows, SSRF, MFA throttling); SSO integration and SSRF protection recur at both Vaultwarden and Passbolt, which is our assessment. Our recommendation for operation: apply updates promptly, make the service reachable only over TLS, restrict the server's outbound connections and follow security reports. For Passbolt (PHP 8.2 or later), the PHP runtime also belongs in the patch process. On the patch cadence, see CVE monitoring and Managed Operations.

What do the BSI and NIS2 say about password managers?

Article 21(2) of the NIS 2 Directive and section 30(2) BSIG name no product called a password manager. Article 21(2) of the NIS 2 Directive requires that the measures "shall include at least the following", among them under point (i) "human resources security, access control policies and asset management" and under point (j) "the use of multi-factor authentication or continuous authentication solutions". The German section 30(2) BSIG lists corresponding points as numbers 9 and 10. Paragraph 1 requires "geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen" (appropriate, proportionate and effective technical and organisational measures). Whether a password manager contributes and which one fits depends on the entity; by the wording checked, it is not expressly required. We did not check implementing acts or sector rules. This is not legal advice. The overview of the NIS2 obligations is in the article Vaultwarden 1.36.0 and NIS2.

On its page on password managers for consumers, the BSI writes: "Ja, in der Regel lohnt sich der Einsatz eines Passwort-Managers." (Yes, as a rule, using a password manager is worthwhile.) As a drawback it names that, in the worst case, all passwords can be stolen at once. We found no separate recommendation for businesses on that page.

Which common misconceptions are there?

When does which option fit?

The following points are our assessment and not a vendor statement.

Vaultwarden is a likely fit when a small to mid-sized team should work with the official Bitwarden clients, no licence costs should arise and SSO through OpenID Connect is enough. That includes accepting work without vendor support and applying updates promptly. We did not find SCIM, SAML or a contract with a response time for Vaultwarden in the sources checked.

Bitwarden self-hosted is a likely fit when the vendor itself should be the contract partner, SCIM, Directory Connector and vendor certifications are needed and an Enterprise subscription is planned for the organisation on your own server. Count in the installation ID, the licence file, MSSQL in the standard installation and the Bitwarden License for SSO and SCIM.

Passbolt is a likely fit when teams manage access together (IT team, service accounts, CLI and API), a European vendor with published audit reports is wanted and the key process with personal recovery data can be introduced; Pro also offers an account recovery. The Community Edition is free for small teams without SSO and audit log; from SSO, directory or SCIM onwards, Pro with at least 10 users is needed.

Status and methodology

As of: 10 November 2026. The basis is licence files, documentation, pricing pages, release pages and security reports of the three projects as well as the BSI publications, retrieved on 10 November 2026, each linked in the text. Prices apply on the day of retrieval; the calculation for 100 users is our own. "Not found" means we did not find the feature in the documentation named and is no evidence of its absence. Our own assessments are labelled. The count of security reports covers 1 January to 10 November 2026 and is not a quality ranking; the Vaultwarden figures are our own count of the published advisories retrievable through the GitHub API, by publication date. The BSI details come from the results report, and the press release evidences the publication date. Release dates are UTC dates from the GitHub API. Open points: database details for Passbolt, the scope of the certifications for self-operated instances, CVE entries for Bitwarden outside GitHub and the current status of the BSI findings on Vaultwarden. Later changes are not included.

Our approach at WZ-IT

Vaultwarden. We install, host and operate Vaultwarden for your company, either on our infrastructure in Germany or at other locations, or on-premises in your environment, with 24/7 monitoring, backups and maintenance. Response and support times depend on the service level you choose. We test the clients and features you need against the versions in use before production, because Vaultwarden is an unofficial implementation. In the Secure Access and Identity package we operate Vaultwarden together with managed NetBird and Keycloak or Authentik for sign-in. The package for Git, CI and registry also includes Vaultwarden for team credentials; dynamic secrets for pipelines are not part of it.

Passbolt. For Passbolt we offer managed hosting with a dedicated instance, backup, monitoring and service level, or alternatively operation in your cloud or on-premises. We take over existing Passbolt instances after checking version, edition, database, mail, keys and backup. SSO, directory sync and further features can require a commercial Passbolt edition; we itemise vendor licences separately. Personal recovery kits stay with the users, and a server restore does not replace them; the Pro edition also offers an account recovery as a vendor feature, which administrators have to enable.

Bitwarden. We do not offer Bitwarden as hosting. We install and operate it as your own instance on your infrastructure and on your behalf. According to the licence notice on our Bitwarden page, we operate the server under AGPL-3.0 without the modules under the Bitwarden License; enterprise features under that licence are excluded, and WZ-IT is not a contract partner of the vendor. On request, we support you in obtaining any required vendor licence.

Are you weighing Vaultwarden, Bitwarden and Passbolt for your team? We discuss requirements, identity provider and the scope of operation with you. View Vaultwarden operations · View Passbolt · Book an intro call (free and non-binding)

Further guides

• Vaultwarden 1.36.0 and NIS2: Self-Hosted Password Management for SMBs
• Why Enterprises Need CVE Monitoring
• Keycloak Alternatives: Authentik, ZITADEL and More
• OpenBao or HashiCorp Vault: secrets management after the licence change
• Vaultwarden managed hosting
• Secure Access and Identity package

Sources

• Vaultwarden: README
• Vaultwarden: LICENSE.txt (AGPL-3.0)
• Vaultwarden wiki: home and feature list
• Vaultwarden wiki: audits
• Vaultwarden wiki: SSO with OpenID Connect
• Vaultwarden wiki: FAQs
• Vaultwarden wiki: container images and databases
• Vaultwarden wiki: building binary
• Vaultwarden wiki: supporting upstream
• Vaultwarden wiki: LDAP sync
• Vaultwarden release 1.37.5
• Vaultwarden release 1.37.4
• Vaultwarden release 1.37.0
• Vaultwarden release 1.35.0
• Vaultwarden security advisories
• BSI: code analysis of KeePass and Vaultwarden (14 Oct 2024)
• BSI: results report on Vaultwarden (mgm security partners, PDF)
• ERNW Insinuator: authentication bypass in Vaultwarden, CVE-2024-55225
• Bitwarden Server: LICENSE.txt
• Bitwarden Server: LICENSE_AGPL.txt
• Bitwarden Server: LICENSE_BITWARDEN.txt
• Bitwarden Server: LICENSE_FAQ.md
• Bitwarden Server: bitwarden_license directory
• Bitwarden Server: SECURITY.md
• Bitwarden Server: releases
• Bitwarden Server: security advisories
• Bitwarden: pricing
• Bitwarden: business pricing
• Bitwarden help: self-host Bitwarden
• Bitwarden help: Linux installation and requirements
• Bitwarden help: Lite installation
• Bitwarden help: licensing self-hosted organisations
• Bitwarden help: plans compared
• Bitwarden help: audits and certifications
• Bitwarden help: hosting FAQ (installation ID)
• Bitwarden: request installation ID and key
• Bitwarden help: connect clients to your own server
• Passbolt API: README
• Passbolt API: LICENSE.txt (AGPL-3.0)
• Passbolt API: CHANGELOG
• Passbolt API: releases
• Passbolt: self-hosted pricing
• Passbolt: cloud pricing
• Passbolt: security and audit reports
• Passbolt docs: server requirements
• Passbolt docs: SCIM
• Passbolt docs: MFA policy
• Passbolt docs: account recovery
• Passbolt: Pro terms of service
• NIS 2 Directive (EU) 2022/2555 on EUR-Lex
• BSIG section 30 risk management measures
• BSI: managing passwords with a password manager
• Bitwarden help: External database
• Vaultwarden wiki: Mobile client push notifications