Before you start #

Passyble Server ships with the source code, which is coming to GitHub. The commands below are how it works once it's published. See Passyble Server for the status.

Passyble Server keeps the locked vault file, older versions of it and backups. It never sees a master password. You need a computer that's always on (a home server or a rented server with Linux, or anywhere Docker runs) and an address your devices can reach: a web address, or a name or address on your home network.

Run setup #

Run pass-server setup. It asks a few questions and sets up a secure connection that fits your address:

  • A web address (like pass.example.com): it gets a free certificate for you, or uses one you already have.
  • Just a home network address: it makes its own certificate. The apps recognise it from the invite link, so nobody has to install anything.

It can also set up e-mail (for invite links and Forgot password?) and backups, testing both right away, then creates your account and prints an invite link and QR code.

Start it #

  • Linux: the install script installs pass-server, runs setup and starts it as a service.
  • Docker: docker compose up -d runs setup on the first start. docker compose logs pass-server shows your invite link.
  • By hand: pass-server serve.

Add people #

pass-server user add [email protected] creates an account. With e-mail set up, Alice gets a one-time link to choose her own password, so you never know it. pass-server invite alice prints a sign-in link and QR code.

Her password is also her vault's master password. The server never sees it.

Connect your devices #

  • Windows: on the welcome screen choose Sign in to Passyble Server, paste the invite link (or type the server address and user name) and enter the password. For a vault you already have: Settings → Sync → Passyble Server → Connect….
  • Android: Sign in to Passyble Server on the welcome screen, or scan the invite QR code.

Typing the address instead of using an invite link? The app shows the server's key: check it matches the one pass-server status prints before you confirm.

Keep an eye on it #

  • pass-server doctor checks everything and says how to fix what's wrong.
  • pass-server status shows the server at a glance.
  • Every upload keeps the file it replaced: the last 20 versions, up to 90 days, by default. pass-server versions lists them.
  • Users can sign out a lost device from the apps' device list; you can with pass-server revoke.

If an app says The server's certificate changed, check the server before anyone continues: it may have been renewed, or someone may be intercepting the connection. Then send a new invite link.