Teampass # Teampass ### Self-hosted password management your whole team can trust Folder-level access control · authenticated AES-256-GCM encryption · compliance evidence
**Your secrets never leave your infrastructure.** **🌐 [teampass.net](https://teampass.net)** · **📖 [Documentation](https://documentation.teampass.net)** · **💬 [Discussions](https://github.com/nilsteampassnet/TeamPass/discussions)** · **🐳 [Docker Hub](https://hub.docker.com/r/teampass/teampass)**
[![Release](https://img.shields.io/github/v/release/nilsteampassnet/TeamPass?style=for-the-badge&color=24c8ff&labelColor=0f2740)](https://github.com/nilsteampassnet/TeamPass/releases/latest) [![License](https://img.shields.io/github/license/nilsteampassnet/TeamPass?style=for-the-badge&color=24c8ff&labelColor=0f2740)](LICENSE.md) [![PHP](https://img.shields.io/badge/PHP-8.2%2B-24c8ff?style=for-the-badge&labelColor=0f2740&logo=php&logoColor=white)](https://www.php.net/) [![Docker Pulls](https://img.shields.io/docker/pulls/teampass/teampass?style=for-the-badge&color=24c8ff&labelColor=0f2740&logo=docker&logoColor=white)](https://hub.docker.com/r/teampass/teampass) [![Stars](https://img.shields.io/github/stars/nilsteampassnet/TeamPass?style=for-the-badge&color=24c8ff&labelColor=0f2740)](https://github.com/nilsteampassnet/TeamPass) [![CodeQL](https://img.shields.io/github/actions/workflow/status/nilsteampassnet/TeamPass/codeql.yml?branch=master&style=for-the-badge&label=CodeQL&labelColor=0f2740&color=3fb950&logo=github&logoColor=white)](https://github.com/nilsteampassnet/TeamPass/actions/workflows/codeql.yml) [![Docker Build](https://img.shields.io/github/actions/workflow/status/nilsteampassnet/TeamPass/docker-publish.yml?branch=master&style=for-the-badge&label=Docker%20Build&labelColor=0f2740&color=3fb950&logo=docker&logoColor=white)](https://github.com/nilsteampassnet/TeamPass/actions/workflows/docker-publish.yml) [![Security policy](https://img.shields.io/badge/Security-policy_%26_advisories-3fb950?style=for-the-badge&labelColor=0f2740&logo=shieldsdotio&logoColor=white)](https://github.com/nilsteampassnet/TeamPass/security/advisories) [![Sponsor](https://img.shields.io/github/sponsors/nilsteampassnet?style=for-the-badge&label=Sponsors&labelColor=0f2740&color=ff4dda&logo=githubsponsors&logoColor=ff4dda)](https://github.com/sponsors/nilsteampassnet)
--- ## Contents - [About](#about) - [Who it's for](#who-its-for) - [Security](#security) - [Features](#features) - [Get started](#get-started) - [Documentation](#documentation) - [Languages](#languages) - [Community](#community) - [Support Teampass](#support-teampass) - [License](#license) --- ## About **Teampass is an open-source credential vault you run yourself.** No account to create, no company behind the curtain holding your data — just a PHP/MySQL application on your own server, with folder-level access control, per-user encryption keys and a full audit trail. It has been built and maintained since 2009, driven by what real teams actually run into: who should see which credential, how to prove it to an auditor, and how to stop passwords living in chat threads and spreadsheets.
Teampass interface
📸 More screenshots
**Items and secrets** Item list Item detail **Folders and roles** Folder tree Roles Role rights Role assignment **Authentication and MFA** MFA setup OAuth2 settings **Encryption keys** Key management Key regeneration **Search, export, one-time view** Keyword search Export One-time view TOTP **Background tasks** Tasks Task settings
--- ## Who it's for
### 🏠 Individuals & Homelab ***Own your vault, literally.*** - Runs on a Raspberry Pi or a €5 VPS - Personal folders encrypted with your own key - Import from Bitwarden, LastPass, 1Password or KeePassXC - Free forever, no sign-up required ### 👥 Teams & SMB ***Stop sharing passwords in chat.*** - Folders and roles instead of a shared document - A record of who accessed what, and when - Secure Send for clients and contractors - Browser extension for day-to-day autofill ### 🏛️ Enterprise & Regulated ***Prove your access controls, don't just claim them.*** - Access recertification campaigns with immutable decisions - Compliance reports and evidence export - LDAP/AD with nested groups, OAuth2 SSO - Data classification and ownership
--- ## Security ### Encryption you can describe to an auditor Secrets are encrypted with **AES-256-GCM** using random nonces and per-secret salts, under **256-bit object keys**. The private key that unlocks them is derived from your password with **PBKDF2-SHA256 at 600 000 iterations**. - **Authenticated encryption** — tampering is detected, not silently decrypted - **Per-user key distribution** — every user holds their own RSA-wrapped copy of each object key, so removing an account actually revokes access instead of just hiding a button - **Lazy migration** — format upgrades happen on access, with no maintenance window
Teampass encryption model
### Transparency over silence > A password manager that reports no vulnerabilities is not a password manager that has none. Findings are triaged, fixed and published as GitHub Security Advisories with CVE identifiers. - 🔒 [Security policy and how to report](SECURITY.md) - 📋 [Published advisories](https://github.com/nilsteampassnet/TeamPass/security/advisories) - 🛡️ [Security hardening guide](https://documentation.teampass.net/#/install/security-hardening) **Found a vulnerability?** Please report it privately through [GitHub Security Advisories](https://github.com/nilsteampassnet/TeamPass/security/advisories/new) — never in a public issue. --- ## Features
🗂️ Folder and role access control
- [Folders](https://documentation.teampass.net/#/features/folders) — unlimited nesting, per-folder password complexity rules - [Roles](https://documentation.teampass.net/#/features/roles) — grant access by role, not user by user - [Rights](https://documentation.teampass.net/#/features/rights) — read, write, no-edit, no-delete, resolved least-permissive-wins - [Users](https://documentation.teampass.net/#/features/users) — per-user overrides on top of roles - Personal folders that nobody else can read, including administrators
🔐 Authenticated encryption
- [Encryption model](https://documentation.teampass.net/#/install/encryption) — how keys are derived, wrapped and distributed - [Encryption improvements](https://documentation.teampass.net/#/install/encryption-improvements) — the AES-256-GCM format and its lazy migration - [Key management](https://documentation.teampass.net/#/features/keys) — regeneration, recovery, per-user key repair
📊 Security posture
- Security Posture Dashboard scoring weak, reused and breached credentials - [Breach detection](https://documentation.teampass.net/#/features/breach-detection) — Have I Been Pwned checks without sending your passwords - [Password renewal](https://documentation.teampass.net/#/features/renewal) — expiry policies and reminders - [Micro-learning](https://documentation.teampass.net/#/features/micro-learning) — in-app nudges instead of a yearly slideshow
🏛️ Governance and audit
- [Access reviews](https://documentation.teampass.net/#/manage/access-reviews) — recertification campaigns with immutable decisions - [Compliance reports](https://documentation.teampass.net/#/manage/compliance-reports) — evidence you can hand to an auditor - [Rotation tracking](https://documentation.teampass.net/#/manage/rotation-tracking) — what was rotated, when, by whom - [Leaver risk](https://documentation.teampass.net/#/features/leaver-risk) — what a departing user could still know - [Data classification](https://documentation.teampass.net/#/features/classification) — ownership and sensitivity labels
🪪 Identity integration
- [Authentication](https://documentation.teampass.net/#/features/authentication) — local, LDAP/AD with nested groups, OAuth2 / SSO - Multi-factor: TOTP (Google Authenticator), Duo Security, YubiKey, AGSES - [Network ACL](https://documentation.teampass.net/#/manage/network-acl) — restrict access by IP range - [Session management](https://documentation.teampass.net/#/misc/session-management) — timeouts, concurrent sessions, Redis-backed storage
🤖 Automation
- [REST API](https://documentation.teampass.net/#/api/api-basic) — JWT-authenticated, OpenAPI 3.1 spec, Bash and PowerShell clients - [Browser extension](https://documentation.teampass.net/#/misc/extension) — autofill, capture, one-click auto-configuration - [Background tasks](https://documentation.teampass.net/#/manage/tasks) — key distribution, notifications, maintenance - [Real-time collaboration](https://documentation.teampass.net/#/features/collaboration) — WebSocket sync and edition locks - [Backups](https://documentation.teampass.net/#/features/backups) — scheduled, encrypted database dumps
📦 Migration in and out
- [Import](https://documentation.teampass.net/#/features/import) — Bitwarden, LastPass, 1Password, KeePassXC, CSV - [Export](https://documentation.teampass.net/#/features/export) — CSV, PDF, and a self-contained encrypted offline HTML vault - No lock-in: it is your database, on your server, under GPL-3.0
⚡ Daily productivity
- [Search](https://documentation.teampass.net/#/features/search) — across labels, descriptions, tags and custom fields - [Command palette](https://documentation.teampass.net/#/features/command-palette) — keyboard-first navigation - [Favourites](https://documentation.teampass.net/#/features/favourites) and quick access to recent items - [Custom fields](https://documentation.teampass.net/#/features/custom-fields) — individually encryptable, role-restricted - [Knowledge base](https://documentation.teampass.net/#/features/knowledge-base) and [notification center](https://documentation.teampass.net/#/features/notification-center) - One-time view links and Secure Send for sharing outside the vault
--- ## Get started ### Requirements | | | |---|---| | **Database** | MySQL 5.7+ or MariaDB 10.7+ | | **PHP** | 8.2 or newer (tested against 8.3) | | **Required extensions** | `openssl` `mysqli` `mbstring` `bcmath` `iconv` `xml` `gd` `curl` `gmp` — plus `ldap` for LDAP/AD | | **Recommended extensions** | `apcu` (config cache) · `opcache` (performance) · `redis` (HA sessions) · `pcntl` + `posix` (WebSocket daemon) | Teampass follows active PHP support. Running the latest stable PHP release is strongly recommended for both security and performance. ### 🐳 Docker ```bash docker run -d --name teampass \ -p 8080:80 \ -v teampass_data:/var/www/html \ teampass/teampass:latest ``` Images are published to both registries: - Docker Hub — `teampass/teampass` - GitHub Container Registry — `ghcr.io/nilsteampassnet/teampass` 📖 [Docker guide](docs/DOCKER.md) · [Migrating an existing install to Docker](docs/DOCKER-MIGRATION.md) ### 🖥️ Bare metal (recommended for production) Installing directly on a PHP/MySQL server gives the best performance and the most control over your environment. - 📖 [Official installation guide](https://documentation.teampass.net/#/install/installation) - 🔄 [Upgrade guide](https://documentation.teampass.net/#/install/upgrade) - 🔑 [File permissions](https://documentation.teampass.net/#/install/file-permissions) - 🎥 [Video tutorial](https://youtu.be/eXieWAIsGzc?feature=shared) --- ## Documentation | | | |---|---| | 📖 **[Full documentation](https://documentation.teampass.net)** | Install, features, administration | | 🚀 **[Installation](https://documentation.teampass.net/#/install/installation)** | Step-by-step first setup | | 🔄 **[Upgrade](https://documentation.teampass.net/#/install/upgrade)** | Moving between versions | | 🛡️ **[Security hardening](https://documentation.teampass.net/#/install/security-hardening)** | Production checklist | | ⚙️ **[Performance](https://documentation.teampass.net/#/install/performance)** | PHP-FPM, caching, tuning | | 🔌 **[REST API](https://documentation.teampass.net/#/api/api-basic)** | Endpoints, JWT auth, clients | | 🧩 **[Browser extension](https://documentation.teampass.net/#/misc/extension)** | Setup and usage | | 🩺 **[Troubleshooting](https://documentation.teampass.net/#/misc/troubleshooting)** | When something goes wrong | --- ## Languages Teampass ships in **25 languages**, translated by the community.
English French German Spanish Italian
Portuguese Portuguese (BR) Dutch Russian Ukrainian
Polish Czech Hungarian Romanian Bulgarian
Greek Turkish Swedish Norwegian Estonian
Catalan Chinese Japanese Vietnamese 🇸🇦 Arabic (in progress)
Translations are managed on POEditor — a few strings from you go a long way. [![Help translate](https://img.shields.io/badge/Help_translate-POEditor-24c8ff?style=for-the-badge&labelColor=0f2740)](https://poeditor.com/join/project?hash=0vptzClQrM) --- ## Community ### Contributing Contributions of any kind are very welcome. Fork the repo, make your changes, then open a pull request — see [CONTRIBUTING.md](.github/CONTRIBUTING.md) for the development setup, coding standards and branch conventions, and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for how we work together. [![Submit a PR](https://img.shields.io/badge/Submit_a_PR-GitHub-%23060606?style=for-the-badge&logo=github&logoColor=fff)](https://github.com/nilsteampassnet/TeamPass/compare) ### Reporting bugs If something does not work as it should, raise a ticket. Please include the steps to reproduce, your server configuration, and the diagnostic report from **Admin → Bug icon (bottom left)**. [![Raise an Issue](https://img.shields.io/badge/Raise_an_Issue-GitHub-%23060606?style=for-the-badge&logo=github&logoColor=fff)](https://github.com/nilsteampassnet/TeamPass/issues/new/choose) ### Asking questions Questions, deployment advice and ideas belong in Discussions rather than the issue tracker. [![Discussions](https://img.shields.io/badge/Ask_a_question-Discussions-%23060606?style=for-the-badge&logo=github&logoColor=fff)](https://github.com/nilsteampassnet/TeamPass/discussions) ### Contributors Teampass is what it is thanks to these people. [![Contributors](https://readme-contribs.as93.net/contributors/nilsteampassnet/TeamPass?perRow=12&shape=squircle)](https://github.com/nilsteampassnet/TeamPass/graphs/contributors) ### Star history [![Star History Chart](https://api.star-history.com/svg?repos=nilsteampassnet/TeamPass&type=Date)](https://star-history.com/#nilsteampassnet/TeamPass&Date) --- ## Support Teampass Teampass is free, GPL-3.0, and has been maintained by one person since 2009. There is no company behind it — which is exactly the point, and also why support matters. ### What sponsorship funds - **Security work** — triaging reports, fixing them, and publishing advisories with CVEs - **Releases** — testing, upgrade paths, and keeping older installations able to move forward - **Documentation** — the guides at documentation.teampass.net - **Translations** — coordinating 25 languages - **Infrastructure** — Docker images, CI, and the project websites ### Become a sponsor The goal is **100 monthly sponsors**. Every tier helps, and small recurring amounts help most because they make the work predictable. [![Sponsor on GitHub](https://img.shields.io/badge/Sponsor_on_GitHub-nilsteampassnet-%23ff4dda?style=for-the-badge&logo=githubsponsors&logoColor=ff4dda)](https://github.com/sponsors/nilsteampassnet) [![Donate via PayPal](https://img.shields.io/badge/One--off_donation-PayPal-00457C?style=for-the-badge&logo=paypal&logoColor=fff)](https://www.paypal.com/donate/?hosted_button_id=XUVWYJ7J92X6L) ### Sponsors Huge thanks to everyone who sponsors this work — you keep Teampass free for everyone else. [![Sponsors](https://readme-contribs.as93.net/sponsors/nilsteampassnet?perRow=12&shape=squircle)](https://github.com/sponsors/nilsteampassnet) ### Commercial support Sponsorship funds the free server. The browser extension and professional services fund the roadmap. | | | |---|---| | **Pro Extension** | Browser autofill, capture and phishing protection — from €49/year, 30-day trial | | **Services** | Feature development, deployment assistance, priority handling — quoted per engagement | [![Pricing](https://img.shields.io/badge/See_pricing-teampass.net-24c8ff?style=for-the-badge&labelColor=0f2740)](https://teampass.net/pricing.html) --- ## License Teampass is released under the **[GNU General Public License v3.0](LICENSE.md)**. You are free to use, study, modify and redistribute it — including commercially — provided derivative works remain under the same license. 📋 [Dependency license compliance report](LICENSE_COMPLIANCE_REPORT.md) ---
Made in France **Built and maintained by [Nils Laumaillé](mailto:nils@teampass.net) since 2009.** Copyright © 2009-2026 Nils Laumaillé
[![StandWithUkraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)