Skip to content
Get started

Install Teampass

Docker, Docker Compose or a plain PHP install on a server you already run. Ten minutes either way, and nothing phones home.

Full installation guide Download the latest release
Three steps

From nothing to a working vault

  1. Get the code

    Pull the Docker image, or drop the release archive into your web root.

    docker pull teampass/teampass

  2. Point it at a database

    Create an empty MySQL or MariaDB schema and a dedicated user. The installer creates the tables and writes the configuration.

  3. Run the installer

    Open /install in a browser, work through the checks, create the first administrator, then delete the install directory.

Each step is covered in detail — including reverse proxy, TLS and background task setup — in the installation documentation.

Requirements

What the server needs

Nothing exotic. If you can host a PHP application, you can host Teampass.

Platform

  • Apache 2.4 or Nginx
  • MySQL 8 / MariaDB 10.7 or newer
  • PHP 8.2 minimum — required since 3.2.1.1
  • Tables must use InnoDB
  • A cron entry or scheduler for background tasks

PHP extensions

  • openssl, mbstring, bcmath, gmp
  • iconv, xml, gd, curl
  • mysqli
  • ldap — only if you authenticate against a directory

Teampass stores your organisation's credentials. Put it behind TLS, restrict it to the networks that need it, back the database up, and keep the recovery account somewhere you can still reach when everything else is down.

Right after install

Five things worth doing on day one

Turn on the hardened encryption format

New installations use authenticated AES-256-GCM by default. Upgrades keep the old format until you enable it, then migrate secrets lazily on first read.

Enforce two-factor authentication

Pick a TOTP profile, or wire Teampass to your identity provider over OAuth2.

Model your folders before your users

Folders and roles are where access control actually lives. Getting the tree right first saves rework later.

Import what you already have

Bitwarden, LastPass, 1Password, KeePassXC, KeePass XML and CSV are all supported.

Run the first posture scan

It will tell you how many of the credentials you just imported are weak, reused or overdue for rotation. Expect the number to be higher than you think.

Store the recovery account safely

It is the only account besides the owner that can decrypt personal folders. Treat it accordingly.

Something not working?

Installation problems are usually a missing PHP extension or a database that is not InnoDB. Both are covered in the docs — and the discussions are open if they are not.

Installation docs Ask the community