What does an open source licence actually let you check?
A licence is a permission slip, and it tells you three different things depending on which one you read.
AGPL v3 on Passbolt means the server code is public and that anyone who runs a modified hosted version must publish their changes. GPLv3 on the Proton Pass clients means the code on your device can be read and rebuilt. GPL-2 or GPL-3 on KeePassXC and GPL v2 or later on KeePass cover desktop software that never talks to a vendor server at all.
What a licence does not tell you is whether the published code is the code that runs. Reproducible builds and a signed release are what close that gap, and none of the five tool pages claims them. The practical step is to install from the project's own release channel and check the signatures it publishes.
How does outside verification compare with simply reading the code?
Few buyers will read a password manager's source. What they can use is an examination by someone who did. KeePassXC holds an ANSSI CSPN visa with a stated version, platform and validity window. KeePass lists the same kind of certification plus an EU-FOSSA audit and BSI-sponsored analysis. Passbolt points to independent reports that are publicly available, and Proton Pass cites independent security audits.
The difference is scope. A CSPN visa evaluates one version on one system, an audit report is a snapshot, and code on GitHub changes daily. Treat the three as different kinds of evidence and ask which version was examined before relying on any of them.
Self-hosted or vendor-hosted: which fits an open source vault?
Self-hosting is the main practical reason to want an open licence in a team setting. Passbolt and Psono both run on your own server, and the data then sits wherever you put it. The price is operations: patching, backups, uptime and a recovery plan for the day the admin leaves. A team without someone responsible for that is better off with Passbolt Cloud or Psono's hosted German servers.
KeePass and KeePassXC avoid the question by having no server. Proton Pass is operated by Proton AG, and the tool page describes no self-hosting route. Choose by who will carry the operational work, because the licence permits all of these routes equally.
How hard is it to migrate from a closed manager?
Moving is a file exercise. Export from the old manager as CSV or its own format, import into the new one, then delete the export, because a plain-text export of every password is the most dangerous file you will ever create. KeePass and KeePassXC share the KDBX format, so moving between those two is the easiest path in this list.
Plan for shared credentials separately. Personal items move in an afternoon, but team folders need to be recreated with the right owners in Passbolt or Psono, and that is the point to clean out accounts nobody uses. Leave the old vault in read-only form for a month before closing it.
When is an open source manager not the better choice?
When nobody will operate it. A self-hosted vault without a maintainer ends up unpatched, and an unpatched password server is worse than a closed one run by a vendor with a security team. Teams that need single sign-on, a service level or a vendor to call in an incident may find the closed European managers in the category page a better fit.
It also does not help if the real risk is phishing or a reused master password. Open code does not fix either. Open source is a property of the product, and it carries its value only when you or someone you trust uses it to verify something.
