TeamPass

Teampass is a self-hosted password manager for teams, built for organizations that can't afford to hand their credentials to a third-party cloud. It's been maintained since 2009, runs on Docker or bare metal, and every security and governance feature ships in the free, GPL-3.0 server.

The access model centers on a folder tree. Roles carry preset rights, per-user overrides are available, and the same rules apply in the web interface and through the API. Personal folders are decryptable only by their owner and a designated recovery account.

Encryption is authenticated AES-256-GCM with random IVs, per-secret salts, 256-bit object keys, PBKDF2 at 600,000 iterations, and HKDF-SHA256 key derivation. Tampering is detected rather than silently decrypted. Existing vaults migrate lazily on first read, with no maintenance window required.

Key capabilities include:

• Security Posture Dashboard scores every user out of 100 and surfaces weak, reused, breached, and overdue credentials, with optional Have I Been Pwned checks
• Linux password rotation (LAPR) changes local account passwords over SSH, agentless, recording only passwords the target machine has already accepted
• Governance tools cover access recertification campaigns, rotation policy tracking, leaver risk detection, four-level data classification, and CSV evidence export for auditors
• Secure Send shares a credential outside the vault under an expiry, a view limit, and an optional passphrase
• Identity integration supports LDAP and Active Directory with nested groups, OAuth2 SSO, and configurable TOTP
• Migration imports from Bitwarden, KeePassXC, LastPass, 1Password, and CSV; exports to KeePass 2.x XML
• REST API with Bash and PowerShell clients for scripted credential delivery into pipelines

Teampass has been validated against GDPR, ISO 27001, and ISO 9001 requirements by real organizations. It's a practical fit for IT teams managing thousands of accounts, small charities that need internal control without cloud exposure, and regulated businesses that need audit evidence on demand.

The server is free with no seat limits. A paid browser extension (from €49/year) adds autofill, password capture, and domain matching across Chrome, Firefox, and Edge. Unlike tools such as Passbolt, there's no feature-gated enterprise edition, everything in the server is available to everyone running it.