Is the Passbolt password manager secure against root access, e.g. if I install Passbolt onto a VPS can it be considered secure or could the VPS host access the passwords stored within it?

1 Answer 1


Full disclosure: I'm one of passbolt developer.

If an attacker has root access to the server they can inject additional javascript to try to perform different type of attack. To our knowledge it is not possible to craft a JavaScript that would allow an attacker to get access to the private key of the end user and/or the passphrase. If you manage to craft this, do get in touch with us at [email protected].

That being said, it is possible for the attacker to breach the following: - Confidentiality: the attacker can create/edit a user to trick another user into sharing the password with attacker. This could mitigated in the future using key signatures (for example the admin signing all the users keys). - Availability: root access means obviously that all passwords can be deleted / tampered with. - Integrity: idem.

  • 2
    If an attacker has root access, they can do a hell of a lot more than just inject javascript.
    – forest
    Dec 18, 2017 at 8:04
  • Passbolt is a web based password manager, encryption/decryption is done in the browser extension. (cf. your previous comment mention capturing keystroke on the server, which is not relevant in this case).
    – Remy
    Dec 18, 2017 at 8:34
  • Oh is it a separate extension, not just client-side encryption?
    – forest
    Dec 18, 2017 at 8:42
  • OK then, my bad!
    – forest
    Dec 18, 2017 at 8:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .