Self-hosted Password Managers: what licence are you actually agreeing to
“Self-hosted” and “open source” are not the same promise, and the lists that recommend these projects rarely separate them. This page sorts 7 password managers projects by the licence you are actually agreeing to, as read on 2026-08-20.
2 of 7 are permissive: run them, change them, keep your changes to yourself. 3 are AGPL, where serving a modified copy over a network obliges you to publish those changes, which is the clause that catches people who self-host for a team. 0 are not open source at all, carrying a proprietary or restricted-use licence. The remaining 2 are ordinary copyleft.
| Project | Licence | What that means | Stars | Maintenance | Language |
|---|---|---|---|---|---|
| AliasVault | MIT | Permissive, no strings | 3,042 | Active | TypeScript |
| Psono | Apache-2.0 | Permissive, no strings | - | Not measured | Python |
| Vaultwarden | GPL-3.0 | Copyleft, publish your changes | 65,679 | Active | Rust |
| Teampass | GPL-3.0 | Copyleft, publish your changes | 1,821 | Active | PHP |
| Bitwarden | AGPL-3.0 | AGPL, network copyleft | 19,904 | Active | C# |
| Passbolt | AGPL-3.0 | AGPL, network copyleft | 6,083 | Active | PHP |
| PassIt | AGPL-3.0 | AGPL, network copyleft | - | Not measured | Docker |
What the licence column means
- Permissive (MIT, Apache-2.0, BSD, ISC): do what you like, keep changes private.
- Copyleft (GPL, LGPL, MPL, EPL): changes you distribute must ship their source.
- AGPL, network copyleft: the same, and running it for others over a network counts as distribution. This is the one that surprises people who self-host for a team or a side business.
- Source-available (SSPL, BUSL, Elastic, Commons Clause): not open source. Reading and self-use are usually fine; offering it as a service is not.
- Other / unstated: the dataset lists no licence we could classify. Check the repo before you rely on it.
The Maintenance column is a second, independent check: the age of the most recent commit on the default branch, read from the GitHub API on 2026-08-20. Active is within 180 days, Slowing is 180 to 365, Dormant is over a year, Archived means the maintainer marked the repo read-only, and Not measured means the project is hosted outside GitHub so the check does not apply.
Source data from awesome-selfhosted-data, used under CC BY-SA 3.0. Licence family grouping and maintenance status are computed by this site (from the upstream licence fields and the GitHub API) and are not part of the upstream dataset. Licence classification is a summary, not legal advice: check the project’s own LICENSE file before you rely on it. This page is published under the same licence.