Passbolt

Passbolt takes a distinct approach to team credential sharing by centering all zero-knowledge cryptographic exchanges on the OpenPGP standard. Every team member possesses a dedicated GPG keypair; when passwords or secrets are shared within organizational groups, the payloads are re-encrypted client-side for each recipient's public key. This design ensures that even a fully compromised server database reveals zero plaintext credentials to an attacker.

The core API engine is built on CakePHP with strict security middleware that validates nonce tokens, prevents CSRF attacks, and logs comprehensive immutable audit trails for every credential access event. Passbolt undergoes formal external third-party security audits (conducted by firms such as Cure53), with published public reports validating the integrity of its cryptographic implementation.

With an OpenSSF Scorecard of 8.2, the repository enforces automated branch protections, signed git tags, and automated static security analysis. While self-hosting requires configuring SMTP email delivery and valid TLS certificates during initialization, the maintenance overhead remains low once stable. Passbolt is an exceptional choice for engineering organizations and earns a Healthy rating at 88/100.