Two Self-Hosted Password Vaults, One $60 Wyse Box, and a Dozen People Who Hate New Software

Every small shop we talk to has the same password situation: a spreadsheet named something like passwords_FINAL_v3.xlsx, a browser sync account nobody controls, and one person who knows everything and is currently on vacation. The pitch for self-hosting is obvious — no per-seat subscription, no vendor reading your vault. The catch is that "free" software still wants to be fed.

So we did what we always do here at FreeSoft Labs: pulled a used machine off the shelf and ran the comparison for real. Two password managers, twelve users, sixty days, one $60 thin client. This is the ledger.

The hardware and the plan

Our test box was a Dell Wyse 5070 picked up on eBay for $60 shipped — Celeron J4105, 4GB of RAM, a 32GB eMMC drive, and a fanless chassis you could hide behind a monitor. We swapped in a 240GB SATA M.2 we already had in the parts bin (call it $22 if you're buying one), installed Debian 12 minimal, and put Caddy in front for automatic TLS on a $12/year domain. Both apps ran in Docker with Compose files we could tear down and rebuild in minutes.

The twelve testers were a mix of office staff, two developers, and a bookkeeper — none of them power users, all of them people who will abandon anything that takes more than a couple of tries to log into. That constraint shaped everything that followed.

Install night: 40 minutes versus three hours

Vaultwarden was almost anticlimactic. It's a single Rust binary with a SQLite backend; the whole container idles around 100MB of RAM. We had it reachable over HTTPS, with signups disabled and the admin panel behind a token, in a little under 40 minutes — and 15 of those were waiting on DNS to propagate.

Passbolt took the rest of the evening. It's a PHP application backed by MariaDB, and the setup itself is well documented. The friction is everything around it: mail delivery for invitations, correct permissions on the volume mounts, and the GPG layer that makes Passbolt Passbolt. Three hours of wall-clock time, plus a second pass the next morning when invite emails from our SMTP relay landed in spam. Total RAM footprint clocked in around 750MB with MariaDB humming along.

Neither number is scary for a sysadmin with a free Saturday. Both are terrifying for the office manager who inherited IT duties along with the supply closet.

Onboarding a dozen people

Here's where the two products stop being the same kind of thing.

Vaultwarden speaks the Bitwarden protocol, which means your users install the official Bitwarden browser extension and mobile app, point them at your URL, and log in. That's it. Average enrollment time across our twelve testers: four minutes. Shared credentials lived in a collection attached to the organization, and the only support question we fielded all month was "why are there two login boxes?"

Passbolt is browser-extension only when it comes to day-to-day use, and it is built on OpenPGP from the ground up. Every user generates a key pair, downloads a recovery kit, and gets verified by an admin before they can see a single password. This is genuinely stronger security posture — it's the reason defense-adjacent teams like it — but it costs you. Average enrollment: 18 minutes per person, with three of our twelve needing a second sitting because they closed the setup tab early and lost their place.

Multiply that out and you're at roughly 48 minutes of total onboarding for Vaultwarden versus about 3.6 hours for Passbolt. Then add the two-hour floor-walk where we explained to everyone, twice, that the recovery kit PDF is not a document to delete.

The Tuesday the admin got locked out

We scheduled the lockout drill for day 41: simulate the primary admin being unavailable, then measure how fast a normal human gets the org back to working order.

With Vaultwarden, this was a 12-minute exercise. The admin panel uses a separate token, so we pulled the token off the container's filesystem, signed in, and re-issued invites. Nobody's vault was touched.

Passbolt made us earn it. Losing admin access in a GPG-backed org means another admin has to perform the recovery, which means you need a second admin account that isn't sitting on the same laptop as the first — a rule we had written down and, embarrassingly, not fully followed. Untangling it took about 90 minutes of careful work with the documentation open in another tab. Nothing was lost. It was simply slow and required understanding things that a small-office generalist shouldn't be forced to understand.

Backups, the boring part that decides everything

Both got the same treatment: a nightly Borg backup to an external USB SSD, encrypted, with a restore test on day 30 and again on day 58.

Vaultwarden's restore was a docker compose up and a SQLite file dropped back into place. Ten minutes, including the coffee.

Passbolt's restore meant database dump plus the GPG keys plus the gpg volume plus the app config, all in the right order. It worked — but there are more moving pieces that can be out of sync, and the failure mode when they are is confusing rather than obvious.

The actual bill

We priced internal labor at a conservative $45/hour, which is roughly what a competent generalist costs a US small business once you account for overhead.

Line item	Vaultwarden	Passbolt
Thin client + storage	$82	$82
Power (60 days, 8W avg, $0.17/kWh)	$2	$3
Domain + TLS	$2	$2
Initial setup labor	$30	$135
User onboarding (12 seats)	$36	$162
Troubleshooting + lockout drill	$45	$270
Backup + restore testing	$22	$45
Total, 60 days	~$219	~$699

Set either of those against a commercial password manager at $4–$6 per seat per month — $288 to $432 for twelve people over the same window — and the story writes itself. Vaultwarden comes out ahead on raw cost. Passbolt comes out ahead only if the GPG model solves a problem you actually have.

What we'd tell a US shop

If you run a 5-to-50 person business where IT is a hat somebody wears between other jobs, put Vaultwarden on a cheap box behind Caddy and stop reading comparison articles. It's fast, it's light, the Bitwarden clients are polished on every platform we tried, and recovery won't ruin your week. Harden it properly: disable open registration, put the admin panel behind a token, force 2FA, and keep the backups offline.

Choose Passbolt if you have a real sysadmin, a compliance requirement, or a team that genuinely wants per-user cryptographic key control and can tolerate the enrollment ceremony and the browser-extension-first workflow.

What you should not do is assume "free" means "no invoice." The invoice just comes in hours instead of dollars, and the thin client is the cheapest part of the whole project.