IT and systems
Auditable password management, with no extra infrastructure.
Passhield encrypts passwords on the device; the server never sees plain text. You grant access through groups and exceptions through timed access; every access goes into a chained log that can be verified offline.
Technically
Zero-knowledge architecture
Keys derived with Argon2id, encryption with XChaCha20-Poly1305, signatures with Ed25519; all with libsodium.
An honest security statement
What the server sees and does not see, and the limit of the "use" permission, are written out on the security page.
A verifiable log
Download the audit chain as NDJSON and verify it offline with the command-line tool.
Four permission levels
Use, reveal, edit, manage; for groups and people, with an end date if needed.
Key renewal
When someone loses access, the vault key is marked for renewal; an administrator renews it with one button.
- Coming soon
Your own server
The same product is designed to run as a single-organisation install, without reaching the internet.
Migration
Move from what you have without losing anything.
Import a spreadsheet or another password manager's export. The file is read and encrypted in the browser; no plain text reaches the server. Passhield finds the duplicates.
Migration optionsPassword health
Old and ownerless items on one list.
Owners are reminded when a password's change interval runs out; items without an owner, or whose owner has left, are reported. Items marked critical create mandatory tasks at offboarding.
Audit and reportsEvery technical detail is open.
Read the cryptographic design and what the server sees on the security page.