Best self-hosted password managers for small IT teams

Self-hosting your team’s password manager is either exactly right or completely unnecessary, and there is not much middle ground. Done for the right reasons, it gives you control, keeps your most sensitive data on infrastructure you own, and answers compliance questions before they are asked. Done for the wrong reasons, it is a server nobody wants to patch, holding the keys to everything.

This guide is for small IT teams weighing that decision honestly. It covers the self-hosted options that are actually worth running, what separates them, and which fits which kind of team. The goal is not to talk you into self-hosting. It is to make sure that if you do, you pick the right tool and know what you are signing up for.

Short verdict:

• Vaultwarden is the lightweight default: Bitwarden-compatible clients, tiny footprint, easy to run.
• Passbolt and Psono are the team-first, control-first options when security architecture matters more than convenience.
• Bitwarden self-hosted is for teams that want the official stack and vendor backing on their own hardware.
• KeePassXC is the edge case for tiny or air-gapped setups that do not want a server at all.

When self-hosting is worth it

Be clear about the why before the which. Self-hosting earns its overhead when you have a genuine requirement that hosted services cannot meet: a compliance rule that keeps credential data in-house, a threat model that rules out trusting a third-party SaaS vault, or an environment that is partly offline. If one of those describes you, read on.

If none of them does, the honest answer is that a hosted manager will be less work and just as safe for most small teams, because zero-knowledge encryption means the provider cannot read your vault anyway. Self-hosting to “be more secure” without a specific reason usually trades real operational risk for a feeling. The best self-hosted setup is the one you actually maintain.

What to evaluate

Five things separate these tools in practice, and they matter more than feature checklists:

• Deployment complexity. A single container versus a multi-service stack is the difference between a weekend and a project.
• Browser and daily UX. Adoption lives or dies here. A tool your team avoids is not protecting anything.
• Sharing model. Collections, folders, groups, and per-resource permissions decide whether the right people see the right secrets.
• Admin overhead. Updates, backups, TLS, and recovery are recurring work, not a one-time setup.
• Who owns it. Every option below assumes a named person owns patching and backups. If that person does not exist, stop here.

Vaultwarden: lightweight and Bitwarden-compatible

For most small teams, Vaultwarden is the path of least resistance. It is an independent, Rust-based server that implements the Bitwarden client API, so your team uses the polished official Bitwarden apps and extensions while you run a single, low-resource container. It supports organizations, collections, sharing, member roles, and multiple MFA methods despite its small footprint. Source: Vaultwarden on GitHub.

The trade-off is ownership, stated honestly by the project itself: it is not affiliated with Bitwarden, the maintainers disclaim liability for data loss, and backups are your responsibility. For a capable small team that is a fair deal, and the daily experience is excellent because the clients are Bitwarden’s own. If this is your pick, we wrote a full Vaultwarden setup guide covering Docker, TLS, and backups properly.

Passbolt: team-first and granular

Passbolt is built for teams from the ground up, with a permission model designed around sharing specific credentials with specific people. It uses OpenPGP, encrypting each secret separately for every authorized user, and its Community Edition is free and open source. Paid Pro tiers, vendor-reported from $4.9 per user per month, add SSO, LDAP, and account recovery. Source: Passbolt pricing.

The thing to know going in is that Passbolt is browser-extension-centric and requires each user to set up a GPG key bound to their browser, which is more deliberate onboarding than mainstream tools. That friction buys a genuinely strong, granular security model. It is supported across Docker, Kubernetes, Ansible, and native packages, so it fits most deployment styles. Source: Passbolt installation docs.

Psono: security architecture first

Psono is the pick when the encryption and audit story is the point. It applies client-side encryption before data reaches the server, keeps its code open for public audit, and ships proper audit logging, with all business features free for up to ten users. Source: Psono homepage.

Like Passbolt, it asks for operational maturity in return for control, and it is more platform than a team that just wants a convenient vault needs. For a security-driven or regulated small team, that is exactly the trade you want. Passbolt and Psono are close enough that the choice deserves its own analysis, which we did in Passbolt vs Psono and went deeper in our Psono review.

Bitwarden self-hosted: the official stack on your hardware

If you want the official Bitwarden product but on infrastructure you control, self-hosting it is fully supported and included with the Enterprise plan. You get the same clients, the same enterprise features, and a vendor behind the product.

The cost is weight. The official self-hosted deployment is a multi-container stack with a recommended baseline of a dual-core CPU, 4GB of RAM, and 25GB of storage, running on Docker. Source: Bitwarden self-hosting documentation. That is reasonable for an organization with a compliance reason to keep the vault in-house, and overkill for a small team that just wants a self-hosted vault, which is exactly the gap Vaultwarden fills with the same client ecosystem. We compared the two directly in Bitwarden vs Vaultwarden.

KeePassXC: the no-server edge case

KeePassXC is the option for teams that do not actually want a server. It is a free, open-source, offline password manager that stores everything in a single encrypted .kdbx file. Source: KeePassXC. There is no built-in sync or multi-user model, so “team” use means syncing that file through something like Nextcloud or Syncthing.

That makes it a genuine fit for very small, technical, or air-gapped setups where zero server infrastructure is the goal. It also makes it a poor fit for most teams: there are no per-user permissions, no central admin or audit, no provisioning, and sharing the vault means sharing the master key, with sync conflicts if two people edit at once. Know its lane and it is excellent in it; push it beyond that lane and it breaks down fast.

The real cost is time, not licensing

The pricing on these tools is the least important number in the decision, and treating it as the main one is how teams end up regretting a self-hosted vault. Vaultwarden, KeePassXC, and the Community Editions of Passbolt are free; even the paid self-hosted tiers are modest per seat. The actual cost is operational time, and it does not show up on an invoice.

Budget for it honestly. Someone has to terminate TLS and keep certificates valid, apply updates after reading the release notes, run and test backups, and own recovery when something breaks at an inconvenient hour. For a capable team that already runs Docker and a reverse proxy, that overhead is small and familiar. For a team stretching to self-host for the first time, it is a new recurring responsibility that competes with everything else on the queue.

This is why the lightweight option usually wins for small teams: every hour you do not spend operating the vault is an hour spent on the work you are actually paid for. Choose the simplest tool that meets your real requirement, because the operational tax compounds for the entire life of the deployment, while the licensing difference is a rounding error.

Choosing by team profile

Match the tool to how your team actually operates:

• Small team, wants lightweight and easy. Vaultwarden. Bitwarden-compatible clients, minimal footprint.
• Security-driven or regulated small team. Psono for architecture-first, or Passbolt for granular team sharing.
• Wants the official Bitwarden product in-house. Bitwarden self-hosted, if you have the hardware and a reason.
• Tiny, technical, or air-gapped. KeePassXC with a synced .kdbx file.

The recurring mistake is choosing on features and ignoring operations. The best self-hosted password manager for your team is the lightest one that meets your actual requirement and that someone will reliably maintain.

Final verdict

For most small IT teams that have a real reason to self-host, Vaultwarden is the sensible default: light, capable, and backed by the Bitwarden client ecosystem. Step up to Passbolt or Psono when control and security architecture are the whole point, move to official Bitwarden self-hosted when you want the vendor’s stack on your own hardware, and keep KeePassXC in your pocket for the genuinely server-less cases.

Whatever you pick, the deciding factor is not the feature list. It is whether you have someone to own it. For the broader picture, including hosted options and how these fit alongside commercial tools, see our hub on the best password managers for IT teams and MSPs in 2026.