What a business password manager costs when you self-host
A team that needs shared credentials under control usually chooses between three paths: a per-user SaaS password manager, an in-house build on Passbolt, Bitwarden or Vaultwarden, or a partner-delivered implementation on infrastructure the organization controls. Software licences are often the smallest line. Passbolt's Community Edition is free to self-host with unlimited users, and Passbolt Pro is listed at $4.9 per user per month billed annually with a 10-user minimum, with volume discounts after 100 users. Most of the total cost sits elsewhere: staff time for installation and hardening, server and backup infrastructure, migration from the current tool, training, and the ongoing work of keeping the vault patched and recoverable.
The answer depends on four variables: user count, the edition features you need, your hosting constraints, and who supports the vault after go-live. Pro-only features such as LDAP and AD provisioning, account recovery, SSO with Microsoft, Google, OpenID or AD FS, MFA policies, syslog activity logs, SCIM and password expiry policies are the usual reason a team moves off Community Edition, so the price comparison should be run on the features you will actually use. Compare that with per-user SaaS pricing for the same headcount over three to five years, and remember that Pro is a subscription that recurs, while server setup and migration are largely one-time effort. Confirm the current price and minimum with Passbolt before budgeting, since list prices change.
Before asking for a quote, ask whether the proposal covers installation, SSO and directory integration, the import from your current tool, backup and restore testing, administrator training and a named owner for patching. For Bitwarden, confirm that paid features require a license file tied to the installation ID, and that the cloud-to-self-hosted migration requires redoing attachments, invitations, enterprise policies and SSO. For Vaultwarden, confirm who answers support requests, because its maintainers state that bug reports go to the Vaultwarden project rather than Bitwarden support. A written scope with these items gives you a comparable total across the three paths.
Which cost components apply in-house, with a partner, and under SaaS
This table compares who pays for each cost component under three models: running a self-hosted vault in-house, buying implementation from a partner, or subscribing to a per-user SaaS vault. Read the one-time and recurring labels first, then check the in-house and partner columns for the work your team would otherwise carry after go-live.
| Cost component | In-house | Partner | SaaS |
|---|---|---|---|
| Software licence or edition | Community editions are free to self-host, but paid features such as Passbolt Pro or a Bitwarden license file carry their own fees (recurring) | Same licence cost as in-house, plus the partner's fixed-scope fee for selecting and configuring the edition (one-time) | Per-user subscription covering the software (recurring) |
| Server and database hosting | Your servers, virtual machines or cloud accounts, plus database licences if you choose one (recurring) | Usually your infrastructure, deployed and documented by the partner, so you still pay for hosting (recurring) | Included in the subscription because the vendor hosts the service (recurring) |
| Backup and restore testing | Your storage, retention policy and staff time to run and test restores (recurring) | Backup design and a one-time restore test in scope, with ongoing backups still billed to you (one-time and recurring) | Vendor backup terms apply. Confirm restore procedures, retention and who can perform a restore (recurring) |
| TLS and reverse proxy | Certificate issuance, renewal and proxy configuration by your team (recurring) | Initial setup in scope, renewals and certificate operations stay with you (one-time and recurring) | Vendor-managed endpoint, so certificate work sits with the vendor (recurring) |
| Directory and SSO integration | Connector setup, group mapping and testing against your directory (one-time, with recurring changes) | Configuration and testing in scope, often the largest one-time item for sync and SSO (one-time) | Often a paid tier or add-on for directory sync and SSO. Confirm the plan that includes it (recurring) |
| Import from the current tool | Export, cleanse and import by your staff, with checks for duplicates and missing fields (one-time) | Import planning and execution in scope, with user communication (one-time) | Vendor import tools or assisted import, depending on the plan (one-time) |
| Rollout and training | Internal project time, communications and user support during onboarding (one-time) | Rollout plan, admin training and user materials in scope (one-time) | Vendor onboarding resources, with internal adoption work still on your team (one-time) |
| Administration and patching | Operating system, container and application updates, monitoring and on-call (recurring) | Optional retainer for upgrades and patching, agreed in writing (recurring) | Vendor performs upgrades and patching. Confirm change notice and maintenance windows (recurring) |
| Vault support after go-live | Internal admins answer access, recovery and sharing requests, with vendor support only if you hold a support contract (recurring) | Support retainer or named escalation path, scope agreed in writing (recurring) | Vendor support tiers apply, with response terms set by the contract (recurring) |
What moves the business password manager cost up or down
A self-hosted vault shifts cost from a per-seat subscription to infrastructure, licensing decisions and the people who run it. The cards below cover the decisions that most change the total, so you can ask a partner or vendor for a quote built on your own user count, feature needs and data.
User count and Passbolt Pro pricing
Passbolt's Community Edition is free to self-host with unlimited users, so seat count does not add license cost there. Pro is listed at $4.9 per user per month billed annually, with a 10-user minimum and volume discounts after 100 users. Confirm current list prices on the pricing page, and ask whether any discount applies to your headcount before comparing against per-user SaaS.
Features that require a paid edition
Several business controls sit behind Passbolt Pro, including LDAP and AD provisioning, account recovery, SSO, MFA policies, SCIM and syslog activity logs. If your audit or identity rules require any of these, the Community Edition is not the baseline for your estimate. List the required features early and price them before you commit to a design.
Bitwarden licenses tied to installation
Self-hosted Bitwarden is free to run, but paid features need a license file downloaded from the cloud admin console and tied to your installation ID. The data region must match the cloud organization's region. Ask the vendor or partner how license renewals are handled, who holds the cloud account, and what happens to paid features if the license lapses.
Hosting footprint and minimums
Bitwarden's Linux guide lists a minimum of 2 GB of RAM and 12 GB of storage, with 4 GB of RAM and 25 GB recommended. Its default MSSQL Express image limits the database to 10 GB. Vaultwarden runs on far less hardware but still needs HTTPS, backups and a database choice. Size the server, database growth and backup storage against your user count before you compare run costs.
Migration and import effort
Moving from a SaaS vault is partly a data task and partly a configuration task. Passbolt imports CSV from common managers and KDBX for KeePass, while Bitwarden's cloud-to-self-hosted move requires attachments, member invitations, enterprise policies and SSO to be redone. Ask for a per-source import plan, a cleanup estimate for duplicate and stale entries, and a list of settings that must be rebuilt by hand.
Shared accounts and folder design
The number of shared accounts, groups and folders drives both rollout time and long-term administration. Every shared service account needs an owner, a sharing list and a rotation rule, and a poor folder structure is expensive to fix after users have adopted it. Ask the partner to inventory shared credentials in the scoping phase, then price the design workshop and the cleanup separately from the platform itself.
Why the licence model changes the bill more than the software price
The software price is often the smallest number in a self-hosted vault budget, because the licence model decides whether the product can be used in production at all and whether a line item recurs. Passbolt Community Edition is licensed under AGPL-3.0 and allows unlimited users, so its software cost is zero, but the features that many business teams expect, such as LDAP and AD provisioning, account recovery, SSO, MFA policies, syslog activity logs and SCIM, sit in Pro, which is priced at $4.9 per user per month billed annually with a 10-user minimum. Vaultwarden is also AGPL-3.0 with no per-seat fee, but the project does not offer vendor support and its README asks users to report problems to the Vaultwarden project rather than to Bitwarden. The support contract, not the licence, is therefore the cost you must budget for.
Self-hosted Bitwarden needs a closer read. The main server is AGPL 3.0, but files in the bitwarden_license directory, including the Commercial.Core and SSO modules, fall under the Bitwarden License, which the Bitwarden server license FAQ describes as source-available rather than open source. That license permits development and testing, while production use requires a paid subscription. Paid features also depend on a license file downloaded from the cloud admin console and tied to the installation ID, so the subscription is a recurring cost that must be renewed and that must match the data region of the cloud organization. Ask the vendor to confirm in writing which components your deployment will run, the renewal terms and whether a license covers the features you plan to use, and have counsel review the terms before you commit.
How to build your own cost estimate
This sequence turns a vague budget question into a like-for-like comparison of self-hosted Passbolt, Bitwarden and Vaultwarden against per-user SaaS over the same period. Each step produces a figure or decision you can place in one shared worksheet.
Count active users and shared accounts
Start with a headcount of people who will log in to the vault, split by group such as administrators, clinicians, engineers and contractors. Next, list shared accounts, service accounts and break-glass credentials, because each shared item affects sharing design and per-seat licensing differently. Confirm how the vendor counts a user, including whether suspended or guest accounts are billed. The step is done when you have one user count per group, a shared account inventory, and a written note on each vendor's counting rule.
Map required features to editions
List the features each user group needs, such as LDAP or Active Directory provisioning, SSO, MFA policies, account recovery, activity logs, SCIM and password policies. Check each feature against the edition comparison published by the vendor, since Passbolt, Bitwarden and Vaultwarden differ in which capabilities sit in paid or community builds. Bitwarden's license terms also require a paid subscription for production use of its licensed server code, so record that as a line item. The output is a feature-to-edition matrix that states which edition each option requires.
Size hosting and the reverse proxy
Choose the server option and size the hosts it needs, along with a database, HTTPS termination and a reverse proxy. Bitwarden's Linux guide lists minimum and recommended resources and requires Docker Engine 26 or later, while Vaultwarden is documented as lighter and recommends PostgreSQL for larger deployments. Passbolt supports several Linux distributions, Docker, Kubernetes and Ansible, so confirm which fits your platform team. Ask your infrastructure owners for virtual machine or container costs, load balancer or ingress charges, and certificate management effort. Done when you have a hosting bill of materials per option.
Price backup and restore testing
Backups are a recurring cost and a risk you carry yourself, because the Vaultwarden maintainers recommend regular backups of files and the database and disclaim liability for data loss. Estimate storage for database and attachment backups, retention periods set by your policy, off-site copies and encryption of backup media. Also budget time for a restore test, since an untested backup does not prove recovery. Record who runs the test, how often your policy requires it, and what evidence you keep. The step is complete when backup storage and restore testing sit in the worksheet as recurring lines.
Estimate rollout: import, directory sync and clients
Rollout is mostly one-time effort. Plan the import from your current tool, using the import formats each vendor lists, and decide whether cleartext CSV export is allowed under your export policy. Plan directory sync or SSO configuration, deployment of browser extensions and mobile apps to every device, and the migration of attachments, invitations and policies, which Bitwarden documents must be redone when moving from cloud to self-hosted. Include time for pilot users and a cutover window. Ask the implementation partner for a written breakdown of these tasks so the one-time figure can be checked line by line.
Plan training and user support
Budget training for administrators and end users, covering sharing models, recovery procedures, MFA enrollment and what to do when a user loses access. Estimate the internal hours needed to answer first-line questions, since vendor support tiers differ and community editions may have no vendor support contract. Record which questions go to the vendor, which go to the partner and which stay internal. The step is done when training and first-line support appear as separate one-time and recurring line items with named owners.
Assign the ongoing administration owner
Name the person or team who patches the server, renews certificates, applies vendor releases, reviews admin accounts, handles offboarding and runs restore tests. Estimate the recurring hours per month for that owner, and decide whether a support or retainer contract covers upgrades and incidents. Ask any partner or vendor whether support is included in the license, what response commitments exist in writing, and who is accountable for data recovery. The output is a named owner, a recurring effort estimate and a documented support boundary.
Compare totals across the three options
Build one worksheet covering the same period for self-hosted Passbolt, self-hosted Bitwarden, self-hosted Vaultwarden and a per-user SaaS option. Separate one-time costs from recurring costs, and show per-user figures alongside totals so growth is visible. Use the vendor's published price where one exists, flag any figure you could not confirm, and request written quotes for the rest. Passbolt publishes Pro pricing per user with a minimum, while other options need a quote. The sequence is complete when every row has a source, a date and an owner, and a quote request follows the written scope for each option you shortlist.
Build, partner or SaaS: which fits which team
Building in-house means your own engineers install, configure, patch and back up a self-hosted vault such as Passbolt Community Edition or Vaultwarden. Software licenses are not the main cost here, because the community editions are free to run. The cost sits in staff time, on-call coverage and the skills needed to operate a server that holds credentials for the whole company.
- Staff time: Someone must own installation, upgrades, user administration, browser extension rollout and the recovery process, and that work competes with other priorities.
- Patching and upgrades: Passbolt and Vaultwarden both publish frequent releases, so your team needs a tested upgrade path and a way to track security fixes.
- Backup ownership: Your team defines backup frequency, encrypted off-site copies and restore tests. Vaultwarden's README recommends regular backups of files and the database.
- Community support: Free editions are supported through public channels and maintainers, and Vaultwarden states that bug reports belong with its own project, not with Bitwarden.
- Feature gaps: Features such as LDAP provisioning, account recovery and SCIM are Pro features in Passbolt, so a free build may need a different design or a paid edition.
Before choosing this model, confirm who is on call for the vault, how long a restore takes in your environment, and whether the people involved have the time to keep the server patched.
An implementation partner plans, deploys, hardens and documents the vault inside your own cloud account, data center or air-gapped network, under a written scope. Your staff keeps ownership of the data and the server, while the partner carries the project work. Costs are split between a one-time fixed-scope rollout and an optional recurring retainer for support, upgrades and testing.
- Fixed-scope rollout: Scope, deliverables and timelines are agreed in writing before work starts, which makes the one-time cost easier to compare across proposals.
- Hardening and backup design: The partner can set HTTPS, reverse proxy configuration, database choice and backup targets, then test restores before handover.
- Documentation and training: Runbooks, admin guides and user onboarding material remain with your team after go-live.
- Retainer support: Upgrades, patch cycles and incident support can be contracted on a recurring basis, so the vault does not depend on one internal person.
- Ownership boundaries: Your contract should state who holds administrator credentials, who receives vulnerability notices and who approves changes.
Request a quote that separates the one-time rollout from any recurring support, and confirm in writing what happens to the vault if the retainer ends.
A commercial SaaS model means the vendor hosts and operates the vault, and you pay a per-user subscription. Infrastructure, patching and backup are handled by the vendor, which reduces the server work your team carries. The trade-off is that encrypted credentials and their metadata sit in a vendor-operated environment, and your options for location and control depend on the vendor's offering.
- Per-user subscription: Costs recur with headcount, and the plan tier determines which features such as SSO, directory sync or audit logs are included. Passbolt lists Pro at $4.9 per user per month billed annually with a 10-user minimum, as an example of how one vendor structures tiers.
- Vendor-hosted operations: The vendor controls uptime, patching and backup, and your contract defines the service levels you can rely on.
- Data residency: Confirm the region where encrypted vault data, logs and backups are stored, and whether that region can match your legal obligations.
- Control and exit: Ask how you export data, how long the vendor retains it after termination and whether migration back to a self-hosted server is supported.
- Key management: Check whether the vendor can see metadata such as names and URLs, and whether client-side encryption is used for all stored items.
Before signing, ask for the data processing terms, the list of sub-processors, the hosting locations and the exit procedure in writing.
Who supports the vault after go-live
The support question changes sharply by product, so settle it before you choose one. Vaultwarden's README says its maintainers focus on individuals, families and small organizations, that bugs should be reported to the Vaultwarden project rather than to official Bitwarden support channels, and that the maintainers cannot be held liable for data loss. The same README highly recommends regular backups of files and the database. For a Vaultwarden deployment, the backup schedule, restore testing and incident response are your job, and the budget for an internal or partner owner is a recurring cost in the total picture, not a one-time setup line.
Vendor support is a different purchase. Passbolt Pro and Enterprise and paid Bitwarden subscriptions are the routes that bring a commercial support relationship with the vendor, and the Bitwarden licensing model ties paid features to a license file and installation ID that must be managed over time. Ask each vendor in writing what support covers for a self-hosted install, which severity levels and response targets apply, whether the support scope includes server upgrades and database questions, and whether support extends to the SSO and directory integrations you plan to use. Do not assume that a free Community Edition or a community project carries any support commitment.
Whichever route you take, name a single owner for the vault in the quote, with written duties for upgrades, backups, restore tests, admin access reviews and offboarding. Ask a partner to state who responds to a lockout at 2 a.m. and who holds the admin recovery path. Confirm the upgrade cadence against the vendor's release history, because a vault that falls behind on its server version can stop working with current clients. Support terms belong in the scope and the contract, and they should be checked against your own on-call model before go-live.
How much does a self-hosted business password manager cost?
Is the free Passbolt Community Edition enough for a business?
It can be, depending on the features your organization needs. The Community Edition is free to self-host with unlimited users, but the comparison lists several capabilities only in Pro, including LDAP user and group provisioning, account recovery, SSO with Microsoft, Google, OpenID and AD FS, MFA policies, syslog activity logs, password expiry policy and SCIM. If your identity provider integration, recovery process or audit log forwarding is a requirement, the Community Edition may not cover it. Map each requirement against the edition comparison before you decide, and confirm current feature availability with Passbolt.
What does Passbolt Pro cost per user, and what is the 10-user minimum?
Passbolt's pricing page lists Pro at $4.9 per user per month, billed annually, with a 10-user minimum and volume discounts after 100 users. That is a subscription that recurs every year for as long as you use Pro features. Smaller teams pay for at least 10 seats even if fewer people need the vault, so the minimum matters most for small organizations. Confirm the current price, billing terms and any tax or currency rules directly with Passbolt before budgeting, since list prices can change.
What does a self-hosted vault cost beyond the license?
The license is only one line item. You also pay for the server or container platform, storage, database, reverse proxy and TLS certificates, backups stored off the primary system, monitoring, and the staff time to patch and restore the service. Bitwarden's Linux guide lists minimum hardware of 2 GB of RAM and 12 GB of storage, and recommends 4 GB of RAM and 25 GB, which is modest, so infrastructure is often a smaller cost than people expect. The larger costs are usually people time and the backup and restore process, which you should price into the internal budget.
How long do rollout and training take, and what should the scope say?
No duration can be stated here without a written scope, because the time depends on user count, number of shared folders, import sources, directory integration, and how many approval and recovery rules you define. Ask any partner for a written scope that lists the editions, environments, import plan, SSO or directory work, pilot group, training sessions and handover tasks, with a timeline agreed in writing before work starts. DeployOpen works on fixed-scope engagements, so the scope document is where these estimates should appear.
What does our team need to provide during implementation?
Expect to supply named owners for the identity provider, the network and DNS records for the vault URL, a TLS certificate path, a backup target, and decisions on folder structure, sharing model and recovery policy. Someone must also collect and validate the existing credentials for import, since Passbolt's import documentation lists CSV sources such as LastPass, 1Password, Dashlane and Bitwarden. Agree in advance who approves test users, who signs off on the pilot, and who receives training. Missing inputs are the most common reason rollouts slip, so ask for this list in the scope.
Can our own staff run the password manager after go-live?
Yes, if you have people who can operate a containerized or Linux-based service. Passbolt supports Docker, a Kubernetes Helm chart and several Linux distributions, and Vaultwarden recommends container images and a reverse proxy. Day-to-day tasks include applying upgrades, checking backups, rotating TLS certificates, managing user lifecycle, and responding to access requests. Skills needed include Linux administration, container operations, database basics, reverse proxy and TLS configuration, and an understanding of the vault's encryption model, so that recovery decisions are made correctly.
What happens to the vault if the implementation partner leaves?
The vault keeps running on your infrastructure, because the software and your data sit in your environment, and the partner does not hold the data. The risk is operational: nobody may know how the deployment was built, how backups are configured, or how upgrades are performed. Protect against this by requiring documentation, runbooks, access to the infrastructure accounts owned by you, a tested restore, and a clear handover in the contract. For Vaultwarden, the project states that its maintainers cannot be held liable for data loss and recommends regular backups of files and the database, so backup ownership must be assigned to someone on your team.
Which costs recur, and which are one-time?
One-time costs usually include the implementation scope, data import, integration and training. Recurring costs include Pro subscriptions where used, infrastructure, backup storage, security patching, upgrades and any support retainer. Bitwarden notes that paid features require a license file tied to the installation and that a cloud-to-self-hosted move requires redoing attachments, member invitations, enterprise policies and SSO, so migration is a one-time cost that can be significant. Ask a quote to separate these categories so you can compare build, partner and SaaS options on the same basis.
What to ask for in a written quote
A written quote should state the edition and feature list it covers, because the cost picture changes sharply once directory sync, SSO, account recovery, MFA policies and activity logs are in scope. The Passbolt comparison, for example, lists LDAP provisioning, account recovery, SSO, MFA policies, syslog activity logs and SCIM as Pro features not in Community Edition, so ask the vendor or partner to name each one and say whether it is licensed, configured or both. Also state the current user count, the expected growth over the contract period, and whether per-user licensing is billed annually with a minimum seat count. For self-hosted Bitwarden, confirm that paid features require a license file tied to the installation ID and data region, and ask who obtains and renews it.
The hosting section should name the operating system, container or Kubernetes platform, database, reverse proxy, TLS approach and sizing assumptions, along with the backup and restore test scope. Ask for the restore test to be written as a test, with a stated success condition, a named environment and a date window, since a backup that has never been restored is an unverified assumption. Directory and SSO integration, import sources (for example, which exports from the current tool are in scope), and the number of training sessions, documentation deliverables and administrator handover should each be itemized. Finally, require support hours, response terms and escalation paths, and mark every line as one-time or recurring. Compare quotes only when they cover the same scope, the same user count and the same term, or the difference in price will reflect what was left out rather than real value.
How DeployOpen scopes and supports a password manager rollout
DeployOpen plans, implements, customizes, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside your own infrastructure, so the cost question is answered against a written scope rather than a list price. We start from how many users, shared accounts, directories and servers your organization has, then put the build, partner and SaaS options side by side.
How we scope
- We confirm user counts, shared and service accounts, and which edition features your sharing and recovery model requires.
- We document the hosting target, whether cloud accounts, data centers or air-gapped networks, and who pays for servers and backups.
- We agree deliverables, timelines and responsibilities in writing before any work starts, since most engagements are fixed-scope.
How we build
- We install the chosen server, configure HTTPS, database, backups and directory sync inside your environment.
- We test import from your current tool, sharing rules, account recovery and the audit log settings against the agreed scope.
- We harden the deployment and record the configuration so the license and support costs match what was actually built.
How we hand over
- We deliver runbooks covering upgrades, backup restores, user onboarding and offboarding, and the edition limits you accepted.
- We train administrators and document the cost components, including which items recur each year and which were one-time.
- We provide a handover record listing owners for the server, database, license renewals and the vault after go-live.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, scoped in writing alongside the build.
- We can review upgrade releases and security fixes against your installed version and schedule the work with your change process.
- Ask any partner, including us, to confirm response expectations, upgrade responsibility and who is accountable for vault data during an incident.
