Really wanted to move to Passbolt, but without support for Passkeys it is dead in the water.
It’s 2026, so two years and you still do not support them, like any other password manager nowadays is deeply troubling.
1 Like
I understand where you’re coming from. We’re currently focused on offline mode, and passkeys/WebAuthn support and encrypted file attachments are among the most requested features after that.
It’s also worth noting that a lot of the work we’ve done over the past few years has been security, infrastructure, and maintenance work that isn’t always visible as a user-facing feature.
Thanks for the feedback. That said, saying the project is “dead in the water” because a particular feature isn’t available yet isn’t especially constructive and doesn’t really help us understand your requirements.
Hi remy, thanks for taking the time to respond — genuinely appreciated.
That said, I’d push back a little on framing “dead in the water” as unconstructive. It’s actually quite precise feedback: passkey storage is no longer a differentiating feature — it’s a baseline expectation for any password manager in 2026. 1Password, Bitwarden, Dashlane, Proton Pass, and even KeePassXC have had it for a while. When a core credential type is missing after three years, “not viable for our stack” is a fair and honest assessment, not a complaint without substance.
And three years is exactly what we’re talking about. This feature request was opened in 2023. The web was already moving fast on WebAuthn back then, and the industry has since fully standardised around passkeys. It’s genuinely hard to understand how this hasn’t made it out of the backlog in that timeframe — not as an attack on the team, but as a signal of misaligned priorities from the perspective of anyone evaluating Passbolt today.
What makes it even harder to square is your public roadmap: passkeys as a content type are still sitting in the backlog, while “MFA with Passkey” — using a passkey to log into Passbolt — is what’s currently in progress. I get the security rationale, but from an end-user perspective that ordering is difficult to defend: the vault will soon accept a passkey to unlock it, but still can’t store or autofill one. That’s exactly the kind of thing that disqualifies a tool for teams running a modern security stack.
I’m not here to pile on — I actually want Passbolt to succeed, which is why I’m raising this directly. The open-source, self-hosted, EU-based angle is genuinely compelling. But passkey support as a content type needs a concrete timeline, not an indefinite spot in the backlog.
All I can say is that the feature is not being ignored, and the demand for it is well understood. It’s also not sitting randomly in the backlog waiting for someone to notice it; it’s currently planned as part of our 2026 roadmap following the work we’re doing on offline mode.
That said, I think you’re now moving from providing feedback to repeatedly arguing the same point. We understand that the absence of passkey storage is a blocker for your use case. Reiterating that it should have been done years ago doesn’t give us much new information to act on.
If you’d like to be constructive, it would be more helpful to understand your actual use case, how your team uses passkeys today, and what workflows you’re trying to support. That kind of feedback helps us design and prioritize the feature much more effectively than repeated criticism of its absence.
1 Like
End user as well as self-hosted admin here. First off, I really appreciate the product and all of the hard work that the developers do to make this a useable and secure product.
To help with understanding use case: I personally use passbolt and love it. I love that it’s self hosted so my passwords and keys don’t leave my control, and the best feature for me is the sharing/permissions capabilities. I run a few businesses, and have a family on the side (haha). In each of my businesses, I have several accounts with vendors that require logins to websites, and it’s not practical or feasible to have each employee make their own logins to vendor portals(and most vendors don’t want us to anyways). We use passbolt to share the credentials so that all employees have access to the vendor sites. Because I have more than one business, with more than one set of vendors and logins even to the same vendors, but different accounts, the granularity of sharing is perfect by using groups.
On my personal side, I also share passwords/logins with my wife and my kids for personal accounts. The problem I have now that is being urgent is that many sites are not only supporting passkeys, but REQUIRING them in order to login. Shopify is an example, some microsoft sites are almost at the point where it’s mandatory, or at least EXTREMELY HARD to find where to login with password or other 2FA.
A good example might be a small business that doesn’t have their own email servers might share an outlook.com account for “Sales” or generic emails and needs passkey to login. Another might be a shared Amazon account with passkey enabled. Being able to store passkey and “share” it with others is one of the main features I have been looking and waiting for since some sites have pushed passkeys really hard.
I already have my passbolt instance set up and employees trained, so it’s hard for me to switch, but if I was looking for a new option, I would definitely choose one that had passkey sharing support, which is I think where some of these other posters are coming from when they say “Dead in the water”, it’s a “must have” feature for people looking for a new password vault option today.
I feel that encrypted files and offline mode are more niche use cases, which is where I think some users feel the priority is probably different for them. As an end user, shared passwords/logins is my main use case, so encrypted file attachments and offline mode doesn’t do anything for me, but passkeys would do wonders.
There are workarounds available for both the encrypted file attachments(Just encrypt it or password protect it using another app) or offline mode(Export into CSV?), but no workaround for sharing passkeys that I know of, which is why some users would rather that be the priority since no workaround exists.
Hope this was more constructive feedback.
Hello Everyone!
I created Merge/Pull Requests for “passkeys support” in three ways.
- Passkey support to login into Passbolt.
- Passkey support as MFA for Passbolt login.
- Passkey store support for Passbolt.
I was researching and developing this request on my own. I created one pull requests for three different repositories :
- For styleguide : passbolt/passbolt_styleguide/pull/59 which needs to be improved.
- For api : https://github.com/passbolt/passbolt_api/pull/616 which can be improved also.
- For browser extension: https://github.com/passbolt/passbolt_browser_extension/pull/279 which needs to be improved.
Have a nice day!
3 Likes
Hey @brkfun,
Thanks for the PRs, we’ve been having a look! It will be usefull for the work that is starting this summer, as you mentioned it needs to be improved to fit the way passbolt is built (there are some discrepancies here and there) as well as a deeper look on the security side. But it’s a useful POC that will speed things up!
Cheers,
4 Likes