Bitwarden is the default recommendation for a self-hosted-friendly password manager, but it's not the only option — and depending on what you actually need, it might not be the best fit. Some teams want something smaller and easier to audit than Bitwarden's full stack; others need granular secret-sharing built for IT departments; and some people would rather not have a cloud account at all, even an encrypted one. Here are three real, currently-maintained tools built for those three different situations: PassManagerWeb, Passbolt, and PassKey.
The short version
| Tool | What it's for | Best for | Pricing |
|---|---|---|---|
| PassManagerWeb | Minimal, self-hosted password manager built with Django | Developers who want something small and auditable, not a full product | Free, open source (MIT) |
| Passbolt | Team-oriented secret sharing, so IT staff never see plaintext passwords | IT/DevOps/security teams that need to share credentials without exposing them | Community edition free & unlimited; Pro from €4.5/user/month (10+ users) |
| PassKey | A fully offline vault that never talks to the internet at all | Windows users who want zero cloud dependency, even Bitwarden's self-hosted server | Free, open source (GPLv3) |
PassManagerWeb — small enough to actually read the code
PassManagerWeb is a deliberately minimal, self-hosted password manager built with Django, using AES-256 GCM encryption with built-in MFA and brute-force protection. It's aimed at developers who'd rather self-host something compact and auditable than deploy Bitwarden's full server stack.
Forces: AES-256 GCM encryption plus MFA; built-in anti-brute-force protection; a compact, auditable Django codebase; free and open source.
Limites: there's no browser extension or mobile app, so autofill and cross-device convenience are on you; it's a very small project that hasn't seen much independent security review; and it has no team or organization features at all — it's single-user by design. It lists Vaultwarden, Bitwarden and KeePass as direct alternatives in its own comparison data.
Pricing: free and open source (MIT license), self-hosted only.
Passbolt — built for IT teams, not just individuals
Passbolt targets a problem Bitwarden's consumer-first design doesn't fully solve: letting IT staff share logins and secrets across a team without anyone ever seeing the plaintext password. It offers end-to-end encryption with a full audit trail, granular sharing down to individual passwords, secrets, or private keys, and an EU-hosted cloud option if data residency for GDPR matters to you.
Forces: Community Edition is free with unlimited users, not just a trial; genuine end-to-end encryption with audit logging; granular, secret-level sharing controls; EU cloud hosting available for GDPR compliance.
Limites: SSO, LDAP and self-service account recovery are locked behind the paid Pro tier; that Pro tier also requires a minimum of 10 users, which prices out very small teams; and the interface is more utilitarian than a consumer-facing tool like Bitwarden's apps. It names Bitwarden, KeePass and Keeper as its own direct alternatives.
Pricing: Community Edition free and unlimited (self-hosted, AGPLv3); Pro at €4.5/user/month billed annually (10-user minimum); Enterprise on quote with a 4-hour SLA.
PassKey — no cloud, no account, no sync
PassKey goes further than "self-hosted": your vault, encrypted with AES-256-GCM and an Argon2id key derivation, lives only on your Windows PC. There's no server to run, no account to create, and nothing ever leaves your machine — which also means there's no cross-device sync to speak of.
Forces: genuinely zero cloud dependency, not even a self-hosted server; modern encryption (AES-256-GCM, Argon2id); 167+ deterministic tests plus Chrome/Firefox extensions with autofill; direct import from Bitwarden, 1Password, and CSV files, so migrating in is easy.
Limites, and this one matters for a password tool specifically: it's an extremely small project (about 2 GitHub stars at the time of writing) with no known independent security audit — unlike Bitwarden or Vaultwarden, which have both been through third-party review. It's also Windows-only with no sync between devices. Trusting your entire password vault to an unaudited, low-visibility project is a real trade-off, not a minor footnote — weigh it accordingly before committing your primary vault to it.
Pricing: free and open source (GPLv3), 100% local — no account or subscription of any kind.
Which one should you actually pick?
If you want something self-hosted but smaller and more readable than Bitwarden's full stack, and you're comfortable being your own only user, PassManagerWeb is the leanest option. If you're managing credentials for a team and need IT staff to share secrets without ever seeing them in plaintext, Passbolt's free Community Edition is the more purpose-built choice. And if your priority is avoiding cloud dependency entirely — not even a self-hosted server, just a vault on your own machine — PassKey does that, but only after you've weighed its lack of independent audit against how much you're trusting it with.