Passbolt vs LastPass
Last updated October 2026
Looking for a European alternative to LastPass? Here's how Passbolt compares, on EU hosting, GDPR and what it does.
Our pick for a European buyer: Passbolt. We weight data residency, GDPR and EU jurisdiction above everything else — that is the constraint this directory exists to solve.
What it is
Open-source team password manager with end-to-end encryption
Password manager for teams and businesses with SSO and MFA.
Headquarters
🇱🇺 LU
🇺🇸 US · 2008
EU data residency
Yes, for all customers
Available on some plansEU data residency is available for Business customers on request.
DSGVO / GDPR
Yes
Yes
Certifications
SOC 2 Type II
ISO 27001, ISO 27701, SOC 2 Type II, SOC 3, BSI C5, FIDO2 Server
Price from
€4.50/user/mo
$4.25/user/mo
Free plan
Yes
No
Open Source
Yes
No
Integrations
Microsoft Entra ID, Google Workspace, OpenID Connect (OIDC) IdPs (Keycloak, Okta), Microsoft AD FS, PingOne +6
Okta, Microsoft Entra ID, Google Workspace, OneLogin, Splunk +2
Where each one wins
Passbolt
Strengths
- +Open-source architecture with full transparency and auditability
- +Self-hosting capability for complete data control behind own firewalls
- +Zero-knowledge, OpenPGP end-to-end encryption for client-side credential security
- +Granular team password sharing with intuitive role-based access control (RBAC)
- +Free Community Edition with full functionality for startups and budget-conscious teams
- +Lightweight and fast core web application performance
- +Responsive community forum and open developer support for feedback and bug fixes
Limitations
- −Complex setup and deployment requiring DevOps and command-line skills
- −Clunky browser extension with frequent session timeouts and re-login prompts
- −Limited vault item types (focused on logins/passwords, lacking support for credit cards, secure notes, etc.)
LastPass
Strengths
- +Strong password generation and autofill
- +Centralized admin console for teams
- +Wide range of MFA options
- +SSO integration with major providers
Limitations
- −Past security incidents raised concerns
- −Limited export formats (CSV only)
- −Advanced features locked to higher tiers
- −Learning curve for new admins
Data residency & compliance
Passbolt
LastPass
EU data residency
Yes, for all customers
Available on some plansEU data residency is available for Business customers on request.
Transfer mechanism
Not required — data stays in the EU
EU-US Data Privacy Framework
Certifications
SOC 2 Type II
ISO 27001, ISO 27701, SOC 2 Type II, SOC 3, BSI C5, FIDO2 Server
Pricing
Passbolt
- Community Edition (Self-Hosted) Free Unlimited usersOpen-source (AGPLv3) · Self-hosted deployment
- Pro Edition (Self-Hosted) €4.50 per user / month, billed annually (min. 10 users)Volume discounts above 100 users · Free trial on request
- Enterprise Edition (Self-Hosted) On request Custom annual subscriptionHigh availability/disaster recovery consulting · Custom SLA and phone support
- Cloud Business €5 per user / month, billed monthly (min. 10 users)Hosted in Google Cloud (Belgium, Germany) · 7-day free trial
- Cloud Sovereign €7 per user / month, billed annually (min. 10 users)Hosted in Luxembourg (sovereign private data center) · Compliant with ISO 27001, GDPR, NIS2, DORA
- Cloud Enterprise On request Custom annual subscriptionIsolated container deployments · 24/7 SOC monitoring and 4-hour SLA
Volume discounts apply for Pro Edition above 100 users. Custom pricing for Enterprise and Cloud Enterprise plans.
LastPass
- Teams $4.25 per user/monthBilled annually · Basic admin controls · Shared folders
- Business $7 per user/monthBilled annually · 100+ security policies · Up to 3 SSO apps
- Business Max $9 per user/monthBilled annually · Unlimited SSO apps · Advanced MFA
14-day free trial available for business plans. Free personal plan limited to one device type.
Features
Passbolt
- Credential & Secret Management
- Secure storage of passwords, TOTP, and encrypted notes, Custom fields and secret history tracking, Password expiry policies
- Collaboration & Access Control
- Private and shared folder structures, Granular sharing permissions and tagging, Role-Based Access Control (RBAC) and user/group management
- Security & Authentication
- Per-user/per-secret end-to-end encryption (OpenPGP), Zero-knowledge metadata mode, Multi-factor authentication (MFA/2FA) with Duo, YubiKey NFC, and TOTP, Anti-phishing token mechanism
- Client Applications & Usability
- Browser extensions (Chrome, Firefox, Edge, Brave), Native desktop (Windows) and mobile apps (iOS, Android), Command Line Interface (CLI) and offline vault mode, KDBX/CSV import and export
- Administration & Compliance
- Activity audit logs with SIEM/Syslog export, Self-registration with domain allowlists, Centralized account recovery (Escrow), Server health checks
LastPass
- Vault and credentials
- Encrypted password vault, Password generator, Autofill, Secure notes
- Administration and policy
- Admin console, Security policies, Group management, Role-based administration
- Authentication and SSO
- Multi-factor authentication (MFA), Single Sign-On (SSO), Up to 3 SSO apps (Business), Unlimited SSO apps (Business Max)
- Security monitoring and audit
- Dark web monitoring, Security dashboards, Administrative reporting, SaaS Monitoring (Business Max)
- Integrations
- Okta, Microsoft Entra ID, Google Workspace, OneLogin