What is Passky-Server?

Passky Server is the backend component of Passky, a simple, modern, lightweight, open-source password manager. It uses zero-knowledge encryption with XChaCha20 for data encryption and Argon2id for master password hashing. The server runs on Bun and supports SQLite, MySQL, MariaDB, or PostgreSQL for data storage, with optional Redis for token persistence. It can be self-hosted via Docker Compose (recommended) or Umbrel one-click install. The free plan allows up to 100 passwords per account, while the premium plan ($2/month) offers unlimited passwords. Features include software and hardware 2FA (TOTP and YubiKey), import/export from other password managers, multiple themes, and 25 languages. An admin panel is available for server management. The project is licensed under EUPL-1.2 (releases up to 8.1.8 were GPL-3.0).

Should you self-host Passky-Server?

Passky-Server scores 49/100 on selfhost.directory (how scoring works) and ranks #12 of 28 in Password Managers. It has 241 GitHub stars.

It shipped 1 stable release in the past year. The latest, v9.0.0, came out on 21 October 2026.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is EUPL-1.2-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is AliasVault (68/100, 3 321 stars). It scores higher overall, so compare the two before you pick. See Passky-Server vs AliasVault side by side.

Features

Admin Panel
Argon2id password hashing
Email username recovery
Export to other password managers
Hardware 2FA (YubiKey)
Health check endpoint
Import from other password managers
Multi-language Support
Multiple Database Backends
Prometheus Metrics
Rate Limiting
Two-factor authentication (TOTP)
Zero-Knowledge Encryption

How to configure Passky-Server

ACCOUNT_MAX100Maximum number of accounts that can be created
Maximum number of accounts that can be created
ACCOUNT_MAX_PASSWORDS1000Maximum passwords per account
Maximum passwords per account
ACCOUNT_PREMIUM-1Maximum passwords for premium accounts (-1 = unlimited)
Maximum passwords for premium accounts (-1 = unlimited)
ADMIN_PASSWORDAdmin panel password
Admin panel password
ADMIN_SESSION_TTL3600Admin session time-to-live in seconds
Admin session time-to-live in seconds
ADMIN_USERNAMEadminAdmin panel username
Admin panel username
ARGON2_MEMORY_COST65536Argon2id memory cost parameter
Argon2id memory cost parameter
ARGON2_TIME_COST3Argon2id time cost parameter
Argon2id time cost parameter
BURROWGATE_ORIGIN_SECRETOrigin signing secret from BurrowGate's site editor
Origin signing secret from BurrowGate's site editor
BURROWGATE_REPORT_USERNAMESfalseShow signed-in Passky username in BurrowGate's traffic log
Show signed-in Passky username in BurrowGate's traffic log
values: true, false
CF_TURNSTILE_SECRET_KEY1x0000000000000000000000000000000AACloudflare Turnstile secret key for captcha
Cloudflare Turnstile secret key for captcha
CF_TURNSTILE_SITE_KEY1x00000000000000000000AACloudflare Turnstile site key for captcha
Cloudflare Turnstile site key for captcha
DATABASE_ENGINEsqliteDatabase engine when DATABASE_URL is empty
Database engine when DATABASE_URL is empty
values: sqlite, mysql
DATABASE_FILEpasskySQLite database file name
SQLite database file name
DATABASE_URLBun SQL connection string (takes precedence when set)
Bun SQL connection string (takes precedence when set)
values: sqlite://, mysql://, postgres://, postgresql://
LIMITER_ADD_YUBIKEY10Rate limit window for adding YubiKey (seconds)
Rate limit window for adding YubiKey (seconds)
LIMITER_CREATE_ACCOUNT10Rate limit window for creating account (seconds)
Rate limit window for creating account (seconds)
LIMITER_DELETE_ACCOUNT10Rate limit window for deleting account (seconds)
Rate limit window for deleting account (seconds)
LIMITER_DELETE_PASSWORD2Rate limit window for deleting password (seconds)
Rate limit window for deleting password (seconds)
LIMITER_DELETE_PASSWORDS10Rate limit window for bulk deleting passwords (seconds)
Rate limit window for bulk deleting passwords (seconds)
LIMITER_DISABLE_2FA10Rate limit window for disabling 2FA (seconds)
Rate limit window for disabling 2FA (seconds)
LIMITER_EDIT_PASSWORD2Rate limit window for editing password (seconds)
Rate limit window for editing password (seconds)
LIMITER_ENABLE_2FA10Rate limit window for enabling 2FA (seconds)
Rate limit window for enabling 2FA (seconds)
LIMITER_ENABLEDtrueEnable API rate limiting
Enable API rate limiting
values: true, false
LIMITER_FORGOT_USERNAME60Rate limit window for forgot username (seconds)
Rate limit window for forgot username (seconds)
LIMITER_GET_PASSWORDS2Rate limit window for getting passwords (seconds)
Rate limit window for getting passwords (seconds)
LIMITER_GET_REPORT-1Rate limit window for getting report (seconds, -1 = disabled)
Rate limit window for getting report (seconds, -1 = disabled)
LIMITER_GET_TOKEN3Rate limit window for getting auth token (seconds)
Rate limit window for getting auth token (seconds)
LIMITER_IMPORT_PASSWORDS10Rate limit window for importing passwords (seconds)
Rate limit window for importing passwords (seconds)
LIMITER_REMOVE_YUBIKEY10Rate limit window for removing YubiKey (seconds)
Rate limit window for removing YubiKey (seconds)
LIMITER_SAVE_PASSWORD2Rate limit window for saving password (seconds)
Rate limit window for saving password (seconds)
LIMITER_UPGRADE_ACCOUNT10Rate limit window for upgrading account (seconds)
Rate limit window for upgrading account (seconds)
LOG_PRESETLog verbosity preset
Log verbosity preset
values: minimal, standard, detailed, debug
LOKI_PASSWORDGrafana Loki password
Grafana Loki password
LOKI_URLGrafana Loki URL for log shipping
Grafana Loki URL for log shipping
LOKI_USERNAMEGrafana Loki username
Grafana Loki username
MAIL_ENABLEDfalseEnable email for username recovery
Enable email for username recovery
values: true, false
MAIL_HOSTSMTP host
SMTP host
MAIL_PASSWORDSMTP password
SMTP password
MAIL_PORT465SMTP port
SMTP port
MAIL_USERNAMESMTP username
SMTP username
MAIL_USE_TLStrueUse implicit TLS for SMTP
Use implicit TLS for SMTP
values: true, false
METRICS_ENABLEDfalseExpose OpenMetrics at /metrics
Expose OpenMetrics at /metrics
values: true, false
METRICS_TOKENBearer token to protect /metrics endpoint
Bearer token to protect /metrics endpoint
MYSQL_CACHE_MODE0How long getInfo caches user and password counts
How long getInfo caches user and password counts
values: 0, 1 (one minute), 2+ (twelve hours)
MYSQL_DATABASEpasskyMySQL/MariaDB database name
MySQL/MariaDB database name
MYSQL_HOSTpassky-databaseMySQL/MariaDB host
MySQL/MariaDB host
MYSQL_PASSWORDMySQL/MariaDB password
MySQL/MariaDB password
MYSQL_PORT3306MySQL/MariaDB port
MySQL/MariaDB port
MYSQL_SSLfalseEnable TLS for MySQL/MariaDB connection
Enable TLS for MySQL/MariaDB connection
values: true, false
MYSQL_SSL_CA/etc/ssl/certs/ca-certificates.crtPath to CA bundle for MySQL/MariaDB TLS verification
Path to CA bundle for MySQL/MariaDB TLS verification
MYSQL_USERpasskyMySQL/MariaDB username
MySQL/MariaDB username
REDIS_HOSTRedis host
Redis host
REDIS_PASSWORDRedis password
Redis password
REDIS_PORT6379Redis port
Redis port
REDIS_URLRedis connection URL (redis:// or rediss://)
Redis connection URL (redis:// or rediss://)
REPORTS_ENABLEDfalsePublicly expose /?action=getReport endpoint
Publicly expose /?action=getReport endpoint
values: true, false
SERVER_CORES1Number of CPU cores/threads the server has
Number of CPU cores/threads the server has
SERVER_HOST0.0.0.0Bind address inside the container
Bind address inside the container
SERVER_LOCATIONUSISO 3166-1 alpha-2 country code where the server is hosted
ISO 3166-1 alpha-2 country code where the server is hosted
values: ISO 3166-1 alpha-2 codes
SERVER_PORT80Port inside the container
Port inside the container
STATS_ENABLEDfalsePublicly expose /?action=getStats endpoint
Publicly expose /?action=getStats endpoint
values: true, false
TRUSTED_PROXIESComma-separated proxy IP addresses or CIDR ranges allowed to supply client IP headers
Comma-separated proxy IP addresses or CIDR ranges allowed to supply client IP headers
values: IP addresses, CIDR ranges, or 'none'
YUBI_CLOUDhttps://api.yubico.com/wsapi/2.0/verifyYubiCloud API URL for YubiKey verification
YubiCloud API URL for YubiKey verification
YUBI_ID67857YubiCloud API ID
YubiCloud API ID