I need a secure way for our team to share company passwords. What's the best business password manager that is self-hosted?

If this is for a real company/team, my top recommendation is Bitwarden self-hosted—with Passbolt as the strongest alternative.

My shortlist

🥇 I'd choose Bitwarden

Bitwarden's organization model is particularly well suited to a company: you can put shared credentials into collections, control membership through groups, and retain individual vaults separately. Its Enterprise offering supports things such as SSO, organization policies, event logs, and private/on-prem or even air-gapped deployment.

One important distinction: don't confuse Vaultwarden with the official Bitwarden server. Vaultwarden is a community implementation that speaks the Bitwarden protocol and is attractive because it's exceptionally lightweight, but for company credentials I'd favor the official server and vendor support.

🥈 When I'd pick Passbolt instead

If your primary requirement is "our IT/engineering team needs to share lots of credentials with carefully controlled access" rather than a general-purpose password manager, Passbolt deserves serious consideration. It's explicitly designed around team credential sharing and offers an on-premises installation.

What I'd deploy

For a typical 10–100 person company, I'd use:

• Official Bitwarden self-hosted
• Docker deployment on a dedicated VM
• HTTPS behind a reverse proxy
• SSO + mandatory MFA
• Separate collections such as Infrastructure, Finance, SaaS, and Production
• Least-privilege group access
• Multiple organization owners/admins for succession
• Automated encrypted backups, with regular restore tests
• Monitoring and alerting for the password-manager server
• A documented emergency/break-glass procedure

Bitwarden specifically supports multiple owners and has organization event/audit capabilities, which are useful for avoiding a situation where the only administrator leaves the company.

Bottom line: Business + self-hosting → Bitwarden. Credential-sharing-heavy IT team → Passbolt. Small/home-lab team where minimizing server resources matters → Vaultwarden. Security-focused on-prem environment with broader secrets requirements → Psono.

If you tell me your team size, whether you use Microsoft 365/Google Workspace, and whether you need SSO/AD integration, I can narrow this down to the best choice and give you a recommended deployment architecture.

One important distinction: don't confuse Vaultwarden with the official Bitwarden server. Vaultwarden is a community implementation that speaks the Bitwarden protocol and is attractive because it's exceptionally lightweight, but for company credentials I'd favor the official server and vendor support.

🥈 When I'd pick Passbolt instead

If your primary requirement is "our IT/engineering team needs to share lots of credentials with carefully controlled access" rather than a general-purpose password manager, Passbolt deserves serious consideration. It's explicitly designed around team credential sharing and offers an on-premises installation.

When your team needs to balance absolute data ownership with secure credential sharing, self-hosting is the gold standard.

The undisputed top choice for a self-hosted business password manager is Bitwarden , with a lightweight alternative (Vaultwarden ) standing out for resource-conscious teams.

1. The Official Choice:

Bitwarden is widely considered the best overall business option because it offers fully supported, official self-hosting on its Enterprise tier.

• How it works: You deploy the official Bitwarden container stack (via Docker) on your own local server or private cloud.
• Key Business Features: Granular user permissions, collection/folder sharing for teams, directory connector (LDAP/Azure AD/Okta sync), event logs, and custom security policies.
• Security: Uses end-to-end zero-knowledge encryption (AES-256 bit encryption, PBKDF2 or Argon2). The data is encrypted on the user's device before it ever touches your server.
• Cost: Official self-hosting requires the Bitwarden Enterprise plan, making it a predictable per-user business expense while keeping data entirely on-premise or in your private cloud.

2. The Lightweight Alternative: Vaultwarden

Note: Vaultwarden is an unofficial, community-driven alternative.

• How it works: It is a re-implementation of the Bitwarden server API written in Rust. Crucially, it uses the official Bitwarden client apps, browser extensions, and mobile apps.
• Why teams use it: The official Bitwarden backend is resource-heavy because it's built on .NET and designed for massive enterprise scaling. Vaultwarden uses a fraction of the RAM and CPU, running brilliantly on a modest VPS or a small home-lab/on-prem server.
• The Catch: Because it’s community-made, it isn't officially supported by Bitwarden (if the Bitwarden team changes their protocol drastically, there can be a lag in compatibility), and it lacks some high-end corporate compliance reporting features found in Bitwarden Enterprise.

Other Notable Mentions

• Passbolt: An open-source, self-hosted password manager built specifically for teams and web developers. It has a heavy focus on OpenPGP and granular sharing, though its interface is more tailored to tech/dev environments than general corporate use.
• Psono: Another solid open-source, self-hosted option with good enterprise access controls and browser extensions, though it has a smaller community backing than the Bitwarden ecosystem.

Recommendation

• Choose Bitwarden Enterprise if you are a formal business that requires official vendor support, strict compliance, audit logs, and directory integration.
• Choose Vaultwarden if you are a smaller team, startup, or have strong internal IT/DevOps management and want a lightning-fast, zero-cost-license server backend while using the polished official Bitwarden apps.

To help narrow down the ideal setup, let me know:

• How many team members need access?
• Do you need Active Directory / SSO integration (like Azure AD/Okta)?
• Will you host this on an in-office server or a cloud VPS (like AWS/DigitalOcean)?

For a business team, I would shortlist three options rather than pick a single winner. The best choice depends on whether you prioritize team collaboration, vendor support/compliance, or simplicity.

Best overall self-hosted business choice: Passbolt

Best for: IT teams, engineering teams, MSPs, companies that frequently share credentials.

Why it stands out:

• Built specifically around team password sharing, not just individual vaults.
• Supports users, groups, folders, and granular permissions.
• Uses an OpenPGP-based sharing model where credentials are encrypted for specific users.
• Community Edition is self-hosted and open source.

Trade-offs:

• More operational complexity than Vaultwarden.
• Some enterprise features (such as certain directory/SSO integrations) may require paid tiers.

My pick: If you have 5–200 employees and the main goal is "securely share company credentials," Passbolt is the one I would evaluate first.

---

Best polished experience: Bitwarden self-hosted

Best for: Companies that want a mature product, excellent apps, and a vendor-backed ecosystem.

Strengths:

• Excellent browser, desktop, and mobile clients.
• Strong business features: policies, SSO options, reporting, and administration.
• Officially maintained by the same company that runs the service.

Trade-offs:

• The official self-hosted deployment is heavier to operate.
• Some organizational/business features depend on licensing.

My pick: If your company has compliance requirements, procurement requirements, or you need vendor accountability, choose official Bitwarden.

---

Best lightweight option: Vaultwarden

Best for: Small teams, startups, technical organizations comfortable managing their own infrastructure.

Strengths:

• Very lightweight.
• Works with Bitwarden clients.
• Easy Docker deployment.
• Much lower infrastructure requirements than the official Bitwarden server.

Trade-offs:

• It is a community implementation, not the official Bitwarden server.
• You are responsible for more operational risk.

My pick: Great for a small engineering team; less ideal for a company that needs formal support or audits.

---

Comparison

Minimum security setup I would require

Regardless of product:

• Put it behind HTTPS with a valid TLS certificate.
• Require MFA/passkeys for every user.
• Back up the encrypted database and recovery keys.
• Separate admin accounts from daily-use accounts.
• Enable audit logging if available.
• Have an employee offboarding process that immediately revokes access.
• Store emergency recovery information offline.

If you tell me your team size, server environment (Docker/Kubernetes/VM), and whether you need SSO/Active Directory/Google Workspace integration, I can narrow this to a specific recommendation.

Minimum security setup I would require

Regardless of product:

When looking for the best self-hosted business password manager for team credential sharing, a few clear industry standards rise to the top. The "best" choice depends on your team's technical comfort, compliance requirements, and scale.

The top options for self-hosted team password management include:

1. Bitwarden (Official Enterprise Self-Host)
   • The Lowdown: The gold standard for business self-hosting. The official Bitwarden Enterprise server supports robust enterprise features like advanced directory integration (LDAP/SCIM), Single Sign-On (SSO), granular collection sharing, and comprehensive audit logs.
   • Pros: Highly polished, officially supported, works natively with all official Bitwarden browser extensions and mobile/desktop apps, and maintains rigorous security audits.
   • Cons: The official self-hosted enterprise tier requires a paid subscription per user.
2. Vaultwarden (The Lightweight Community Alternative)
   • The Lowdown: An unofficial, incredibly lightweight server implementation written in Rust that is compatible with official Bitwarden clients. It runs seamlessly in a single Docker container and consumes a tiny fraction of the resources that the official Bitwarden stack requires.
   • Pros: Free and open-source, blazing fast, uses minimal RAM (often under 50MB), and lets you leverage the high-quality official Bitwarden apps.
   • Cons: Not officially supported by Bitwarden; enterprise features like native SCIM provisioning or official enterprise support are absent. You are entirely responsible for community-reliant updates and backups.
3. Passbolt
   • The Lowdown: Built from the ground up specifically for teams and digital agencies rather than solo users. It uses OpenPGP for encryption and centers its entire user experience around secure credential sharing and role-based access.
   • Pros: Excellent, highly visual team-sharing interface; heavy focus on OpenPGP trust models; provides a free self-hosted community edition with granular permission controls.
   • Cons: Heavily optimized for browser-based usage; mobile support is less seamless compared to Bitwarden's ecosystem.
4. Psono
   • The Lowdown: Another open-source, highly secure self-hosted password manager built explicitly for enterprise environments. It features browser extensions, multi-layered encryption, and robust sharing capabilities.
   • Pros: Great API support, fine-grained access policies, and the enterprise edition is often free for small teams (under 10 users).
   • Cons: Smaller community ecosystem compared to Bitwarden or Passbolt, meaning a steeper learning curve for self-administration.

To help narrow down the ideal pick, tell me:

• How many team members need access to the vault?
• Do you require advanced enterprise features like SSO (Single Sign-On) or Active Directory/SCIM integration?
• Are you comfortable managing a Docker container on your own infrastructure?

For a business team that wants a self-hosted password manager, I’d shortlist these three:

ByteGuard Bitwarden## My recommendation

For most companies:

1. Small company (2–50 people): Passbolt or Vaultwarden

• Choose Passbolt if the main requirement is sharing and controlling access to company credentials (production logins, vendor accounts, infrastructure secrets). Its model is designed around teams, groups, and permission management.
• Choose Vaultwarden if you want the easiest deployment and your team is comfortable operating the server yourselves. It gives you the familiar Bitwarden apps, but you take responsibility for updates and support.

2. Larger organisation or compliance-heavy environment: official Bitwarden

If you need things like:

• SSO integration
• directory provisioning
• formal vendor support
• compliance documentation
• predictable enterprise lifecycle

then official Bitwarden is usually the safer business choice.

What I would avoid

• Shared spreadsheets (even encrypted ones)
• Passwords in Slack/Teams/email
• One admin account shared by everyone
• A self-hosted instance without tested backups and recovery procedures

A solid deployment pattern

For a company, I’d run:

• Linux VM or dedicated server
• Docker deployment
• HTTPS with a proper certificate
• Daily encrypted backups
• MFA enforced for all users
• Separate vaults/collections: - Finance
• Infrastructure
• SaaS accounts
• HR
• Emergency access
• Quarterly access reviews
• Immediate offboarding process when someone leaves

If I were setting this up for a typical small-to-medium business, I’d probably pick Passbolt for a security-first team, or Vaultwarden for a small technical team that wants simplicity. For a regulated or larger company, I’d lean toward official Bitwarden self-hosted.

When looking for a self-hosted business password manager, your options generally split into two main paths depending on your organization's size, budget, and compliance needs: Official Bitwarden (Enterprise) and Vaultwarden , alongside a strong team-centric alternative like Passbolt.

Here is how the top choices stack up for a business environment:

• Official Bitwarden (Enterprise Plan)
  • Best For: Mid-to-large businesses that require official vendor support, compliance certifications (SOC 2, HIPAA, GDPR), and corporate directory integrations.
  • Why choose it: It offers native Bitwarden On-Premises deployment with enterprise-grade features like SAML/OIDC Single Sign-On (SSO) and SCIM provisioning for automated user onboarding and offboarding.
  • The Catch: Self-hosting the official version requires a minimum seat purchase on their Enterprise tier and is resource-heavier compared to lightweight alternatives (recommending a minimum of 2GB RAM).
• Vaultwarden (Community/Unofficial Bitwarden API Server)
  • Best For: Small-to-medium teams, startups, or tech-forward small businesses looking for the best user experience with zero licensing costs.
  • Why choose it: Written in Rust, Vaultwarden is an unofficial, incredibly lightweight alternative server API that is fully compatible with all official Bitwarden client apps and browser extensions. It boots up in a single Docker container using less than 50MB of RAM, handles robust password sharing via "Organizations", and feels identical to the mainstream Bitwarden experience.
  • The Catch: It does not support official enterprise directory sync (SCIM) or enterprise SSO out of the box, and because it's community-maintained, you are responsible for your own updates and backups.
• Passbolt (Community / Pro Edition)
  • Best For: IT departments, dev teams, and sysadmins who need strict, granular, open-source credential sharing.
  • Why choose it: Unlike Bitwarden's model of sharing whole collections/vaults, Passbolt is designed from the ground up for granular, peer-to-peer, folder-nested sharing where you can assign specific read/write/admin rights down to a single password. The Community Edition is open-source and free to self-host.
  • The Catch: It lacks offline access (you must be connected to the server to view/edit passwords) and the user interface/onboarding asks a bit more technical adaptation from non-IT staff.

Recommendation Summary

If your team is non-technical and you need Active Directory/SSO integration and formal compliance , go with Official Bitwarden Self-Hosted . If you want a frictionless, fast, lightweight experience that utilizes the polished Bitwarden browser extensions without the enterprise price tag, deploy Vaultwarden via Docker.

To help narrow down the ideal architecture, could you share:

• How many team members need access?
• Do you require integrations like SSO/SAML (Okta, Entra ID, Google Workspace) or Active Directory sync?

For a company/team, my top pick is official self-hosted Bitwarden. If you want maximum simplicity and are comfortable with community-supported software, Vaultwarden is the lightweight alternative.

My ranking

🥇 Best overall: Bitwarden self-hosted

For an actual business, I'd choose Bitwarden Enterprise self-hosted. It supports centralized ownership, granular access control, SSO, directory/SCIM integration, audit/event logs, and self-hosting. Bitwarden currently lists Enterprise at $6/user/month billed annually, with self-hosting included.

The important distinction is that Vaultwarden is not the official Bitwarden server. Bitwarden explicitly says it cannot guarantee that its official clients will work perfectly with non-official servers.

🥈 Passbolt if sharing is your primary concern

I'd seriously consider Passbolt if your main requirement is:

"Multiple employees need controlled access to shared company credentials, with clear ownership and permissions."

Its architecture is specifically oriented around team password sharing and granular access control.

🥉 Vaultwarden for a small, technically capable team

If you're a small company (say 5–20 people) and already comfortable administering Docker/Linux, Vaultwarden is very attractive. It's dramatically lighter than the official Bitwarden server while working with the Bitwarden client ecosystem.

But I wouldn't make Vaultwarden my first choice for a company with meaningful compliance, SSO, formal IT controls, or a requirement for vendor support.

What I'd deploy

For a typical business, I'd use:

Bitwarden Enterprise self-hosted → Docker/Linux → HTTPS → SSO/SCIM → groups/collections → MFA/passkeys → regular encrypted backups → separate backup/offline recovery procedure.

One important caveat: self-hosting doesn't automatically make passwords more secure. You become responsible for patching the server, TLS, backups, monitoring, database security, and—most importantly—recovering the vault if the server dies. That's the tradeoff versus a managed password manager.

If you tell me team size, whether you use Microsoft 365/Google Workspace, and whether you need SSO/SCIM or compliance (SOC 2/ISO 27001), I can narrow this down to the best choice and give you a recommended architecture.

When looking for a self-hosted business password manager that handles team credential sharing gracefully, a few top-tier options stand out. They balance data sovereignty (keeping your secrets on your own infrastructure) with the user experience your team needs to actually adopt the tool.

• Bitwarden (Official Self-Hosted) : The gold standard for open-source password management. Bitwarden offers an official on-premises/self-hosted deployment.
  • Pros : Full feature parity with their cloud version, supports enterprise policies, directory sync (SCIM), and Single Sign-On (SSO) on enterprise tiers. Uses zero-knowledge end-to-end encryption. Excellent ecosystem of native apps and browser extensions.
  • Cons : The official enterprise container stack is resource-heavy to spin up and maintain compared to lighter alternatives.
• Vaultwarden : An unofficial, ultra-lightweight alternative server implementation of the Bitwarden client API written in Rust.
  • Pros : Uses the official, polished Bitwarden browser extensions and mobile/desktop apps, but the backend runs in a tiny Docker container using less than 50MB of RAM. Perfect for small-to-medium teams wanting a snappy, zero-fuss setup.
  • Cons : Because it’s an independent server implementation, it doesn’t support official Bitwarden enterprise billing/licensing or advanced native SCIM/SSO protocols out of the box.
• Passbolt : An open-source password manager built explicitly from the ground up for team collaboration and IT/development workflows.
  • Pros : Utilizes a unique OpenPGP-based security model designed for granular, role-based sharing. Great API for automation, command-line usage, and integrating with pipeline tools like Ansible.
  • Cons : The UI/UX feels a bit more specialized (tailored heavily toward tech and dev teams), and it lacks an offline mode.
• Psono : Another robust, open-source, and self-hosted enterprise password manager featuring granular permission controls and built-in SSO capabilities.
  • Pros : Highly focused on secure access logging and audit trails for corporate compliance.
  • Cons : The interface is functional rather than flashy, meaning user adoption might require a bit more onboarding for non-technical staff.

To help narrow down which of these fits your layout best, tell me:

• Roughly how many users/seats need access?
• Do you require enterprise features like SSO integration or SCIM directory sync?

For a business team sharing company passwords, I would narrow the field to three serious self-hosted options:

My recommendation by company size

1–25 people:

• Vaultwarden is often the practical winner if your team has someone comfortable maintaining Docker, backups, TLS, and updates. It gives users the familiar Bitwarden apps without running a large stack.
• I would still consider Passbolt if your main concern is shared credentials (AWS accounts, vendors, SaaS admin accounts) rather than personal passwords.

25–200+ people:

• I would lean toward official Bitwarden self-hosted or Passbolt Pro, depending on your requirements:
  • Need SSO, directory integration, vendor support, compliance documentation → Bitwarden.
  • Need strong team-based sharing workflows and internal credential ownership → Passbolt.

Features I would require for a company deployment

Whatever you choose, make sure it has:

• MFA for every user (preferably hardware security keys)
• Role/group-based access control
• Audit logs
• Immediate user removal/offboarding
• Encrypted backups tested regularly
• Separate admin accounts (no shared super-admin login)
• Automatic password generation and rotation procedures
• A documented recovery process

What I would avoid

• A shared KeePass file on a network drive for a real company team. It can work for a few people, but it becomes painful for access revocation and auditing.
• Using a personal password manager account shared among employees.

A solid self-hosted setup

A common production pattern:

• Ubuntu/Debian VM
• Docker Compose deployment
• Reverse proxy (Caddy or Nginx)
• HTTPS with automatic renewal
• Daily encrypted database backups
• MFA enforced
• Vault access restricted by VPN or identity-aware proxy if possible

If you tell me your team size, whether you need SSO/AD integration, and whether this is for IT/admin secrets or everyone’s passwords, I can narrow it down to one choice.

When looking for a self-hosted business password manager , your choice ultimately comes down to whether you prioritize ecosystem polish and enterprise compliance or granular, role-based IT collaboration.

The top self-hosted contenders for team and business use break down as follows:

• Official Bitwarden (On-Premises/Enterprise) : The gold standard for corporate self-hosting. It provides a full suite of native clients (iOS, Android, Windows, Mac, Linux, and browser extensions), zero-knowledge end-to-end encryption, and enterprise-grade features like directory sync (SCIM), SAML/OIDC Single Sign-On (SSO), and robust audit logs. Self-hosting the official version requires a Bitwarden Enterprise Plan subscription.
• Vaultwarden : A lightweight, unofficial open-source alternative written in Rust that implements the Bitwarden server API. It consumes a tiny fraction of the resources that the official Bitwarden stack does and works seamlessly with official Bitwarden apps and extensions. While wildly popular for homelabs and micro-teams, it lacks the official enterprise audit compliance, native SSO, and formal third-party corporate audits of the official product.
• Passbolt : An open-source, team-first password manager built explicitly around OpenPGP cryptography. Unlike Bitwarden's collection-based sharing, Passbolt handles credentials via per-user public/private key pairs, offering intensely granular resource-level sharing and revocation tracking. It is heavily optimized for IT and sysadmin teams who need strict governance over who specifically viewed or edited an individual credential, though its client app ecosystem is more heavily tied to browser extensions.

If you tell me:

• Your approximate team size
• Whether you need formal compliance features like SSO/SCIM integration or just straightforward credential sharing

I can help you decide between official Bitwarden, Vaultwarden, or Passbolt.