storage-p vs Passbolt: zero-knowledge & self-hosted
Both storage-p and Passbolt keep secrets safe, but they take different routes. storage-p is a self-hosted, zero-knowledge vault you operate yourself; Passbolt is a self-hostable server. Here is a factual side-by-side.
At a glance
- Hosting: storage-p runs self-hosted on your own server; Passbolt is a self-hostable server.
- Encryption: storage-p is zero-knowledge — your key is derived in the browser with Argon2id and the server only ever stores XChaCha20-Poly1305 ciphertext.
- Beyond passwords: storage-p also stores SSH/TLS keys, API keys and TOTP, and generates Ed25519 SSH keys and self-signed certificates client-side.
- Integrations: storage-p issues scoped API tokens whose every read can require your in-app or Telegram confirmation.
- Both Passbolt and storage-p can be self-hosted; storage-p keeps the database encrypted at rest with SQLCipher on top of client-side encryption.
Where storage-p stands out
The server never sees your master password or plaintext — encryption, decryption, key generation and the security audit all run on your device. You can store and generate SSH/TLS material, share via burn-after-read links or end-to-end sealed-box, and grant integrations narrow, auditable access instead of all-or-nothing exports.
When Passbolt may fit better
Passbolt is a mature, established option with its own ecosystem and community. If you rely on its specific apps or integrations, it may fit your workflow better.
Switching from Passbolt
Moving is straightforward: Passbolt can export your entries to a CSV file, which storage-p imports as a generic CSV. See the step-by-step migration guide linked below.