When Passbolt Community is enough and when Pro is worth paying for
If you run a small team that manages shared accounts by hand and can accept no single sign-on, no directory sync and no enforced MFA policy, Passbolt Community is enough. If your access, provisioning and audit rules require those controls, Pro is the edition that adds them. According to Passbolt's pricing comparison, the features that separate the two are LDAP user and group provisioning from AD or OpenLDAP, account recovery, SSO with Microsoft, Google, OpenID and AD FS, MFA policies, syslog activity logs, tags, passphrase and password policies, a password expiry policy and SCIM. Confirm that list against the current pricing page before you decide, since editions change.
Community fits a team lead who adds and removes people manually, accepts per-user sharing decisions made inside Passbolt, and is satisfied with the audit trail they can read in the product. The condition that matters is joiner and leaver volume. If access changes once a month, manual administration is a reasonable cost. If staff turnover is high or contractors come and go weekly, the manual steps become the main risk, and LDAP provisioning in Pro removes them. Pro also matters when an auditor asks for activity logs sent to a central SIEM, because Pro lists syslog activity logs as a Pro feature. Ask Passbolt whether Community exports logs in any form that your collector can ingest before assuming you need the upgrade.
The Pro price is published as $4.9 per user per month, billed annually, with a 10-user minimum and volume discounts after 100 users. Budget for the minimum seat count even if you are smaller, and ask for a written quote that states the billing term, the seat count and whether discounts apply to your size. Your own costs also recur: someone must run upgrades, backups and the directory connection. Ask your vendor or partner whether a fixed-scope engagement covers the LDAP connection, SSO setup and MFA policy rollout as one-time work, and what ongoing support would cost. Pro is worth paying for when the control gap it closes is one your risk owner has already accepted as unacceptable.
Which Passbolt features are in Community and which need Pro
This table lists the capabilities Passbolt's pricing comparison places in Pro, with Community shown as free self-hosted with unlimited users. Read each row as a question: if your team needs it, Pro is the edition that lists it. Confirm current availability on the pricing page before you buy, since the edition split can change between releases.
| Capability | Passbolt Community | Passbolt Pro |
|---|---|---|
| Price and user limits | Free self-hosted, unlimited users | $4.9 per user per month billed annually, 10-user minimum, volume discounts after 100 users |
| LDAP user and group provisioning from AD or OpenLDAP | No | Yes |
| Account recovery | No | Yes |
| SSO with Microsoft, Google, OpenID and AD FS | No | Yes |
| MFA policies | No | Yes |
| Syslog activity logs | No | Yes |
| SCIM provisioning | No | Yes |
| Tags, passphrase and password policies, password expiry policy | No | Yes |
| Import formats (LastPass, 1Password, Bitwarden, KeePass KDBX and others) | Available in Community, Pro and Cloud alike | Available in Community, Pro and Cloud alike |
What the paid features change in day-to-day access and audit
The main change Pro makes to daily operations is that access can follow your directory instead of being managed by hand inside Passbolt. According to Passbolt's pricing comparison, Pro adds LDAP user and group provisioning from Active Directory or OpenLDAP, SSO with Microsoft, Google, OpenID and AD FS, and SCIM, while Community has none of these. In practice, a joiner gets an account and group memberships from the directory, and a leaver's access can be removed when the directory account is disabled rather than when someone remembers to act on a ticket. Before you decide, confirm with Passbolt exactly which group-to-role mappings and deprovisioning behavior the LDAP and SCIM features support in your identity source, because the pricing page does not describe them.
MFA policies and account recovery are the login-side controls. Pro lets an administrator set MFA policies for the whole organization, so the second factor is enforced consistently instead of depending on each user's choice. Account recovery is also listed as Pro-only, which matters for teams that cannot afford a locked-out user holding shared credentials. Check how recovery is authorized and who can initiate it, and write that into your offboarding runbook. The syslog activity logs are the audit feature a security team is most likely to route into a SIEM. Pro sends activity events to syslog, which a collector can forward for correlation with identity and endpoint data. Confirm the event fields and retention you need with Passbolt before you design the pipeline.
Be fair about when these features are worth the cost. A small team managing a handful of shared accounts may not need directory sync or SIEM forwarding, and Community with disciplined manual offboarding can be adequate. A regulated team with many joiners and leavers, and auditors asking who could read which credential on which date, usually does. The encryption model is the same in both editions. Passbolt uses OpenPGP end-to-end encryption, each user holds a key pair, and each user with access to a shared resource gets their own encrypted copy. The server stores only ciphertext, and encryption and decryption happen in the browser extension or mobile app, not on the server. Pro therefore changes who gets access and what is logged, not what the server can read.
How licensing, support and updates differ between editions
Passbolt Community and Pro share one open-source server codebase under AGPL-3.0, so the difference is mostly in the paid feature set and the vendor relationship around it. The cards below separate what the licence grants from what a subscription adds, and list the terms you need in writing before you commit.
AGPL-3.0 server code
The passbolt_api server repository is licensed under AGPL-3.0, and the official passbolt_docker and charts-passbolt Helm chart repositories carry the same licence. You may run, study and modify this code under those terms. If you modify the server and let users interact with it over a network, AGPL-3.0 obligations apply, so have your legal team review the licence before you add custom code to the server.
Release cadence and version currency
Passbolt v5.16.0 was published on September 17, 2026, after v5.15.0 on August 21, 2026 and v5.14.0 on July 28, 2026. Community operators decide when to pick up each release, and they need a test plan for every upgrade. Ask Passbolt how long each release line receives security fixes before you standardize on one.
What Community depends on
Community Edition is free with unlimited users, and its upkeep rests with your team. You own patching, backups, the database and the operating system, and you rely on public releases and community channels for help. Confirm that this model fits your internal staffing before a production rollout, because no vendor response times come with the free edition.
What Pro adds commercially
Pro is a paid subscription at $4.9 per user per month, billed annually, with a 10-user minimum and volume discounts after 100 users. The subscription buys the Pro feature set, including LDAP provisioning, account recovery, SSO, MFA policies and syslog activity logs, along with vendor support for those features. Ask for the exact support scope in writing, since the price alone does not describe it.
Subscription terms to confirm
The published pricing does not describe contract length, renewal and cancellation terms, true-up rules for added users, or what happens to Pro features if a subscription lapses. Request these terms in writing and check whether an annual commitment applies to the 10-user minimum. Also ask how seat counts are measured for shared users and service accounts.
Support, update windows and SLAs
No support response times, update windows or service levels are supplied for either edition, so do not assume any. Ask Passbolt for the support hours, severity definitions, response targets and the length of security patch support for each release line. Compare those answers against your own change-control and incident response requirements before you choose a tier.
What Pro costs per user and what else the budget covers
Passbolt's pricing page lists Pro at $4.9 per user per month, billed annually, with a 10-user minimum and volume discounts after 100 users. Pro is therefore a recurring subscription that scales with seat count, and the 10-user minimum means a team of four still pays for ten seats. Before you budget, confirm with Passbolt whether the minimum and discount tiers apply to your billing region and contract term, and ask for the annual total in writing for your exact seat count, including any tax or currency conversion. Enterprise is priced separately and is not published, so request a written quote for your seat count if Enterprise features such as the broader support or deployment options matter to you.
Community has no license fee, but it is not free to run. Your team pays for the servers or cloud accounts that host Passbolt, the database and storage, backups and restore testing, TLS certificates, monitoring, and the time to apply upgrades to each release. The hosting guide covers several installation paths, including Docker, a Kubernetes Helm chart, an AWS AMI and Ansible, and each path puts a different share of that work on your staff. Community also means you configure and maintain features such as user provisioning and logging yourself, so any gap you fill with internal engineering or a partner is a cost that Pro's subscription would otherwise cover.
Your budget therefore has three payees. Passbolt is paid for Pro subscriptions, and possibly for Enterprise if you choose it. Your internal platform or IT team is paid through salaries for installation, operations and upgrades. A partner, if you use one, is paid under a written scope for installation, integration, hardening, backup design or ongoing support. Ask any partner for a fixed-scope quote that lists deliverables, responsibilities for upgrades and backups, and what recurs each year, so you can compare it directly with the Pro subscription and decide where the work should sit.
Cost components for Community and Pro
This table sets out the cost components of running Passbolt Community and Passbolt Pro, showing who is paid for each item, whether it is one-time or recurring, and what moves it up or down. Only the published Pro price is stated; every other cell is a driver to price in your own quote.
| Cost component | Passbolt Community | Passbolt Pro |
|---|---|---|
| Software license | Free self-hosted edition with unlimited users, published on the pricing page. No recurring license fee from Passbolt. | Published at $4.9 per user per month, billed annually, with a 10-user minimum and volume discounts after 100 users (Passbolt pricing page). Recurring, and it grows with seat count. |
| Hosting infrastructure | Recurring. You pay for servers or cloud instances, storage, backups and network in your own environment. Size grows with user count and availability needs. | Recurring, same drivers as Community. Pro also offers a virtual appliance, which can change the footprint you run. Confirm supported targets with Passbolt. |
| Installation | One-time effort to deploy on a supported Linux distribution, Docker, Kubernetes Helm chart, AWS AMI or Ansible. Paid internally or to a partner under a fixed-scope written agreement. | One-time effort, similar to Community. Pro adds directory and SSO configuration, which increases setup work. Ask the vendor which Pro installation path your team will use. |
| Identity directory integration | Not included as a Pro feature. Any user management beyond Community scope is manual or built by you. | Included as a Pro feature: LDAP user and group provisioning from AD or OpenLDAP, plus SSO with Microsoft, Google, OpenID and AD FS. Cost is one-time configuration plus ongoing directory changes. Confirm the directory setup in your environment. |
| Upgrades and patching | Recurring staff time to apply releases and test them. Passbolt publishes versions on GitHub, so you own the upgrade schedule. | Recurring, same as Community, plus validation of SSO and provisioning after each upgrade. Retainer support from DeployOpen or another provider can be quoted separately. |
| Backup and restore testing | Recurring. Backups of the database and server configuration are your responsibility. Restore tests need a non-production environment, which adds hosting cost. | Recurring, same as Community. Account recovery and logging features add configuration to test. Ask how recovery keys and encrypted data are handled in your restore process. |
| Ongoing administration | Recurring admin time for user onboarding, offboarding, key-related support and reporting. Grows with headcount and turnover. | Recurring, usually lower for user lifecycle because LDAP and SCIM provisioning reduce manual changes. Policy tuning for MFA, passphrases and password expiry adds ongoing review. |
Moving from Community to Pro and back
This sequence confirms which Pro features your team actually needs, moves identity and policy controls onto Pro, and proves each one works with a pilot group before you roll it out. The reverse path is a licensing and data-handling question to settle with Passbolt before you start.
Confirm the feature gap
Compare your requirements line by line against Passbolt's pricing comparison, which lists the Pro-only features: LDAP user and group provisioning, account recovery, SSO with Microsoft, Google, OpenID and AD FS, MFA policies, syslog activity logs, tags, passphrase and password policies, a password expiry policy and SCIM. Your identity team and the security owner should sign off on the list, marking each item as required, nice to have or not needed. The output is a written gap list that names the features you will actually switch on and the owner of each one.
Purchase Pro seats
Pro is listed at $4.9 per user per month billed annually, with a 10-user minimum and volume discounts after 100 users, according to Passbolt's pricing page. Confirm the seat count, billing period and any volume terms in a written quote from Passbolt before you commit, and ask whether the minimum applies to your deployment. Procurement should record the order and the seat count so that the license matches the users you plan to provision. The check is a confirmed order that matches the seat count in your identity directory pilot.
Connect LDAP or SSO to the directory
Your platform engineers connect Pro to the existing directory, either LDAP user and group provisioning from Active Directory or OpenLDAP, or SSO with the identity provider your organization already runs. Document the bind account, the group filters and the attribute mapping, and keep the change under your standard change control. The output is a saved configuration that you can review and reproduce in a test environment. Confirm the exact supported directory and SSO options with Passbolt, since the pricing comparison names them but does not describe configuration detail.
Test provisioning and login with a pilot group
Select a small pilot group that includes a mix of roles, such as a team administrator, a standard user and one person who will test account recovery. Sync the group, then have each pilot user sign in, create and share a test resource, and confirm that group removals in the directory remove access in Passbolt. Record every failure and rerun the test after each fix. The check is a signed-off pilot log showing successful provisioning, login, sharing and deprovisioning for each role.
Enable MFA policies and activity logs
After the pilot passes, an administrator turns on the MFA policy and sends the syslog activity logs to your central log platform. Set the policy scope to match your access rules, and confirm that the log events reach your monitoring system with the fields your analysts need. Your security team should verify one login, one failed login and one sharing change in the log store. The output is an MFA policy in force and a log stream that your team has tested end to end.
Review the export policy
Since Passbolt 5.10, cleartext CSV exports are disabled by default and the export list offers encrypted KeePass KDBX formats, unless an administrator allows CSV again in the export policies. Decide who may export, which formats they may use and whether any CSV exception is justified, then record the decision in your access policy. The check is a documented export policy that the administrator has applied and tested with a non-privileged account. Keep in mind that imports from Bitwarden, LastPass, KeePass and other managers work on Community, Pro and Cloud alike, so the import path does not change with this step.
Confirm the reverse path with Passbolt
Moving from Pro back to Community is a licensing and data-handling question, not a technical step this page can settle. Before you rely on the reverse path, ask Passbolt in writing what happens to Pro-only settings, directory-linked users, MFA policies and logs when a Pro subscription ends, and how your data would be exported. Your legal and procurement teams should keep the answer with the contract. The output is a written answer from Passbolt that your team can file alongside the license.
Questions buyers ask before choosing Passbolt Pro
How much does Passbolt Pro cost per user, and what does the 10-user minimum mean for a small team?
Passbolt's pricing page lists Pro at $4.9 per user per month, billed annually, with a 10-user minimum and volume discounts after 100 users. Even a team of four pays for ten seats, so the minimum is the first number to model. Teams above ten users pay per seat, so the monthly total grows with headcount rather than with server size. Ask Passbolt for a quote that states the billing term, whether the minimum applies to your tier, and how discounts apply at your user count. The license is recurring, while the work to deploy, configure and migrate is typically one-time, so compare both over at least three years.
Is Passbolt Community safe for production secrets?
Yes, from an encryption standpoint, Community uses the same OpenPGP end-to-end model as Pro. Each user has a key pair, each user with access receives their own encrypted copy, and encryption and decryption happen in the browser extension or mobile app, so the server holds only ciphertext. What Pro adds is administration and control: LDAP provisioning, account recovery, SSO, MFA policies, syslog activity logs, password policies and SCIM. If your production secrets require enforced MFA, centralized offboarding or audit logs shipped to a SIEM, those controls are Pro features and should be a requirement, not an assumption. Confirm current edition contents on the pricing page before you decide.
How long does a Passbolt Pro rollout take, and what drives that effort?
No supplied fact gives a rollout duration, so treat any timeline as something to agree in writing. The main drivers are the shape of your directory, the SSO provider, and the size of the pilot. A flat Active Directory or OpenLDAP tree with clear groups maps to Passbolt's LDAP provisioning quickly, while nested groups, multiple domains or stale accounts add review time. SSO with Microsoft, Google, OpenID or AD FS requires redirect configuration, test accounts and a fallback login plan. A pilot group of a few teams surfaces permission and import issues before the full cutover. Ask for a scope that lists each of these items and the acceptance criteria for each.
What does the internal team need to provide for a Pro deployment?
Plan for four capabilities: directory administrator access to create the LDAP bind account and read the group structure, someone who can run Linux and containers, a change control path for the server and its database, and a named owner for user lifecycle. Installation targets include Debian, Ubuntu, Red Hat family systems, SUSE, Docker, a Kubernetes Helm chart and an AWS AMI. Pro also offers a virtual appliance. You will also need backup and upgrade routines, because you run the server. Confirm with Passbolt which of these tasks are included in your edition and which your staff must perform.
Can our team migrate and run Passbolt without outside help?
A capable platform team often can, provided it has the access and time listed above. Passbolt supports imports from common password managers, including LastPass, 1Password, Dashlane, Bitwarden and browser stores, and CSV and KDBX formats for KeePass. Note that since Passbolt 5.10, cleartext CSV exports are disabled by default, so plan exports in encrypted formats. Self-hosting means your team owns upgrades, backups and incident response. Teams without Linux, database or identity administration experience usually benefit from a fixed-scope engagement that covers the install, directory integration and handover.
When does outside help pay off for a Passbolt Pro deployment?
Outside help tends to pay off when the directory is complex, the team lacks spare administrators, or the deadline is fixed by an audit or a offboarding requirement. DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted platforms in your own infrastructure, typically under a fixed scope agreed in writing before work starts. Ongoing support and upgrades are available as retainers. DeployOpen prepares systems and evidence for compliance assessments, but independent auditors issue any attestation. Request a written scope listing directory integration, SSO, migration, backup testing and handover before deciding.
Which Passbolt edition should a team pick if it needs both LDAP and self-hosting?
Choose Pro if you need LDAP user and group provisioning, because that feature is listed as Pro only in Passbolt's comparison. Self-hosting remains available with Pro, and Pro is the edition that adds the virtual appliance option. Community suits teams that accept manual user management and can live without SSO, MFA policies and syslog logs. Confirm with Passbolt whether your chosen installation method covers every Pro feature, and whether the cloud-managed edition better fits your hosting rules.
How DeployOpen scopes and delivers Passbolt editions
Whichever edition you choose, the scope decides the work, and DeployOpen agrees that scope in writing before any work starts. For Passbolt Community, a scope usually covers installing the server on your own infrastructure, hardening it, setting up backups and proving that a restore works, and documenting how administrators run it. For Passbolt Pro, the scope also has to name the directory integration (LDAP user and group provisioning from AD or OpenLDAP), the SSO configuration, the MFA policy design, the logging path into your SIEM, and the account recovery procedure. Each of those is a separate deliverable with its own acceptance check, so the written scope should list them individually rather than as one line item.
DeployOpen does not publish a price list. A quote follows from the written scope, so the useful question for your team is what the quote will contain. Ask for each deliverable to be listed with its owner, whether the work is one-time or recurring, and which of your staff must take part, such as the people who own your directory or identity provider. Ask how MFA policy decisions, export policy settings and logging retention will be signed off, because those choices shape your security posture long after the project closes. Confirm which Pro features your team needs before scoping, since the features you leave out of scope will not be configured or tested.
Ongoing work is handled separately. Upgrades, support and continuous testing are available as retainers, which is the natural fit for a Pro deployment that depends on a directory connection and SSO, since those integrations need checks when either side changes. Plan for who applies Passbolt upgrades, who reviews the backup and restore test results, and who answers when a directory sync fails. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors and certification bodies issue any audit report or certification, and DeployOpen is not an official partner or certified provider of Passbolt.
