Business password manager requirements checklist

Treat client-side encryption as a testable requirement, not a marketing claim. The question to settle first is whether the server can read credentials, and the answer depends on the product and on settings you control. Ask each vendor to show, in writing, which data is encrypted on the client before it leaves the user's device. A vendor that only says the data is "encrypted" has not answered the question.

Passbolt uses an OpenPGP model. Each user holds a key pair, and when a resource is shared, the client creates a separate copy of the secret encrypted to each authorized user's public key. Passbolt's documentation states that the server only receives and stores ciphertext, and that the browser extension or mobile app performs the encryption and decryption. Note the metadata gap: names, URLs and descriptions are encrypted only with the v5 format and only when the organization enables metadata encryption. Confirm that setting in your pilot, and decide whether your auditors need it on from day one.

For Bitwarden and Vaultwarden, the requirement is the same, but the evidence is different. Ask each vendor to document which vault fields are encrypted client-side, how the server handles the organization keys used for sharing, and what an administrator or database operator can see if they have full access to the server. Ask whether metadata such as item names and URLs is protected in the same way as passwords. For Vaultwarden, which is an independent server implementation of the Bitwarden Client API, ask the maintainers to confirm the encryption behavior directly rather than assume it matches the official service. Record the answers and the version you tested, because they become part of your control evidence.

Account recovery decides how a password manager behaves when a user loses a device, forgets a master password or leaves the company with the only copy of a key. In end-to-end encrypted designs, the server cannot reset a vault for the user, so recovery is a deliberate design choice. An admin-controlled recovery path lets an administrator restore access to a vault, which protects the business from lost data but means the administrator can, in principle, reach encrypted material that belongs to a person. A user-only design avoids that trade-off but makes a lost key a permanent loss. Decide which model your policy and your data owners accept before you choose a product, and write the decision down so auditors can see it was made on purpose.

The edition question often arrives with the recovery question. Passbolt lists account recovery as a Pro feature, not part of the free Community Edition, so a team that needs admin-assisted recovery in Passbolt should price Pro into the design from the start. For Bitwarden, the server code in the main repository is under AGPL 3.0, but files in the bitwarden_license directory, including the SSO integration modules, fall under the Bitwarden License, which the vendor's FAQ says requires a paid subscription for production use. Paid features on a self-hosted Bitwarden installation also need a license file downloaded from the cloud Admin Console and tied to the installation ID, and the data region must match the cloud organization's region. Vaultwarden is a separate AGPL-3.0 implementation that is not associated with Bitwarden, Inc., so its licensing position differs from the official server.

Plan the import as a data migration with known losses, not a copy. Passbolt's import documentation lists CSV imports from LastPass, 1Password, Dashlane, NordPass, Bitwarden, Firefox, Chrome, Brave, Edge and Safari, plus CSV and KDBX for KeePass and KDBX for Keeper, and those lists apply to the Community, Pro and Cloud editions. Confirm the exact source formats and whether your current tool's export includes shared folders, item history, custom fields and attachments, because a plain CSV usually flattens sharing. Expect that attachments, member invitations, enterprise policies and SSO settings will not move with the items in most migrations. For a Bitwarden cloud move, the documented path exports the organization's data, downloads a license tied to the installation ID, creates the self-hosted account with the same email and imports the data, and then requires attachments, member invitations, enterprise policies and SSO to be redone. Put those rebuilds on the project plan as named tasks with owners.

Run a test import before the real one. Choose a sample that includes at least one shared folder, one item shared with a group, one item with a custom field, one service account and one item with an attachment, then import it into a non-production instance. Check where each item lands: folder or collection names, group permissions, and who can see each item after import. Passbolt's export documentation says that since version 5.10 cleartext CSV exports are disabled by default unless an administrator re-enables them in the export policies, so confirm how your source export file will be created and stored. When the test passes, delete the source export file and any copies, such as downloads or ticket attachments, and record the deletion in the migration log. A cleartext export left on a workstation is the most common way a migration leaks every credential it was meant to protect.