Passbolt 5.5: SCIM on Pro, encrypted metadata on Cloud and improved privacy for all

4 min. read

Passbolt team

24 September, 2025

Passbolt 5.5

Passbolt 5.5 is now available (release notes: v5.5.0, v5.5.1) and introduces important updates across all editions of Passbolt.

For self‑hosted Pro, SCIM provisioning (beta) is now available, enabling administrators to automate user management directly from their identity provider.

Passbolt Cloud catches up with self‑hosted as encrypted metadata becomes enabled by default, unlocking multiple URI, custom fields, and all the features built on top of encrypted metadata.

Finally and for all editions, privacy is further reinforced with the introduction of zero‑knowledge mode for encrypted metadata.

SCIM

SCIM 2.0 (beta) is now available on Passbolt self-hosted Pro to automate user provisioning with your identity provider. With SCIM, administrators can create, update, and deactivate users directly from their identity provider, without ever touching the Passbolt UI.

The first release introduces user provisioning for Microsoft Entra ID (Azure AD). Support for group provisioning will follow in future releases, once the challenges around onboarding invited users into groups are resolved.

While Okta is expected to work out of the box, certain scenarios, such as user deactivation, may still require refinement. Over time, we plan to extend support to additional identity providers, and we welcome your feedback on which ones to prioritize.

To learn more about getting started with SCIM, check out the dedicated blog article.

Encrypted metadata and new resource types available for for all

At last, Cloud is catching up! Encrypted metadata and new resource types are now enabled in the Cloud, making support for multiple URIs, custom fields, and icons available for all.

*Fig 2. Main workspace showing resources with encrypted metadata*

Self-hosted and Cloud users who configured Passbolt after version 5.4 can start using the new resource types right away, no additional setup required. For existing instances, please refer to this blog article, which explains how to enable the feature.

Zero knowledge mode for encrypted-metadata

With zero-knowledge mode for encrypted metadata, organizations that prioritize privacy over server-side auditability can ensure that the server never has access to resource metadata. This guarantees that only end users control and access sensitive information, strengthening confidentiality and compliance with strict data protection requirements.

How does it work?

When a new user joins, the server does not automatically share the key with them. Instead, administrators receive an email notification once the user has completed their activation and is ready to be granted access.

From the Users & Groups workspace, administrators can then review the user’s status and decide when to share the key, ensuring access is provided only at the appropriate time.

Fig 3. *Zero-knowledge for encrypted metadata share missing metadata key dialog*

Until a user receives the metadata key, their experience is intentionally restricted. Actions that rely on the shared metadata key, such as sharing a resource, moving a private item into a shared folder, or creating content intended for others, remain blocked.

Fig. 4 *Zero-knowledge refused action dialog*

To know more about the encrypted metadata zero-knowledge mode, check out this blog post.

Bug Fixes and Improvements

This release also includes a number of fixes reported by the community.

A Chrome issue that prevented the browser extension from restarting properly after an update has been resolved. Previously, this could give the impression that the extension was not configured and trigger unnecessary account recovery prompts. We thank the Google team for their collaboration in addressing this issue.

This release also fixes an issue that prevented the Go CLI from handling new resource types. With this fix, version 0.4 is now on track to graduate from beta and provide official support for encrypted metadata and the resource types many users have been waiting for. A big thank you to Samuel for his continued work on the CLI.

What’s Next?

Passbolt 5.6 (October 8th, 2025)

Planned features include encrypted shared metadata key rotation and the introduction of a standalone note resource type.

Passbolt 5.7 (November 12th, 2025)

Secret history, allowing users to access and review previous revisions of a resource’s secret, is under active development and targeted for this release.