Getting started with passbolt
This page is the path a new administrator can follow, from an empty instance to a team that uses passbolt every day. Each step stays short and links to the pages that cover it in detail.
If you would rather hand out ready-made material than read the whole guide, the admin onboarding and user onboarding pages gather slide decks, PDFs and the product tour video.
1. Get your instance running
On a cloud plan there is nothing to install: your instance is ready, so go straight to step 2.
Self-hosted, work through the hosting guide: check the requirements, then follow the installation for your platform. Two things save time later, opening the firewall rules that passbolt needs, and making sure the system clock is synchronised, as a drifting clock makes time-based one-time passwords fail.
Whatever your hosting, finish this step by running the healthcheck and clearing what it reports.
2. Configure the essentials
Both items in this step are for self-hosted instances. On a cloud plan, outgoing email is delivered by the passbolt email service and there is no subscription key to register, so you can move on to step 3.
- Email server: set it up in the email server settings before you invite anyone, as users receive an email invitation to activate their account.
- Subscription key: on the Pro Edition, register your key as described in update the subscription key.
Whatever your hosting, the email notifications settings let you choose what passbolt sends, and to whom.
3. Decide your policies before inviting users
These settings are far easier to choose now than to retrofit on a live instance.
- Account recovery: configure the organisation recovery key first. Without it, a user who loses both their passphrase and their recovery kit loses access to the secrets that only they can decrypt.
- Multi factor authentication, together with the MFA policy that decides whether users are reminded to enable it.
- Single sign-on, if you want your users to authenticate through your identity provider.
- User passphrase policies for the passphrase protecting each private key, and the password policy for the secrets your users generate.
- Role-based access control, to allow or restrict specific actions per role.
- Encrypted metadata: check which format your instance creates for new content, as converting existing content is a separate operation.
4. Structure content and bring your team in
- Design a folder structure and the groups that mirror your organisation, then share at group level rather than user by user. Roles and permissions explains who can do what.
- Provision your users: synchronise a users directory over LDAP, use SCIM with your identity provider, or open self-registration to a chosen email domain.
- Move your existing credentials in with one of the supported import formats, straight into the folder structure you designed.
5. Keep it healthy
- Run the healthcheck again after any configuration change.
- Plan updates and backups from the start, and test a restore at least once rather than discovering it during an incident.
- Password expiry and secret history support credential rotation.
- For offboarding, see delete a user, and mind the secrets they own before removing them.