Password Manager
Secure team vault for passwords, 2FA codes, secure notes, and credentials.
MangoApps
Overview
Password Manager is a secure team vault for logins, credit cards, identities, API credentials, bank accounts, software licenses, and standalone secure notes. Store a 2FA/TOTP secret on any login and the vault generates the rolling one-time code for the whole team. Add custom fields (concealed values revealed on demand with an audit trail), attach files like license PDFs and recovery kits, keep a full password history with one-click restore, and share individual entries with specific people. A Security Health dashboard flags weak, reused, stale, and breached team credentials (via HaveIBeenPwned k-anonymity). Features include role-based access, per-person sharing, per-user favorites, comprehensive audit logging, and encrypted-at-rest storage.
Highlights
Capabilities
Sharing & Team Access Control
-
Personal (private) and team (shared) vaults
-
Public or group/person-restricted access levels (view or edit)
-
Time-limited, auto-expiring access grants
-
Admin restricts who can create team passwords (by group)
-
Admin access review — exactly who can read each shared entry
-
Ownership transfer plus automatic offboarding (reassign owned team entries, revoke inbound grants)
-
External one-time, expiring secure-share links for non-users ("secure send")
Vault, Item Types & Built-in 2FA
-
Seven item types — login, secure note, credit card, identity, API credential, bank account, software license
-
Built-in TOTP authenticator: rolling one-time codes from a stored secret (otpauth:// QR keys supported)
-
Custom fields with concealed values revealed on demand (up to 30 per entry)
-
Per-entry file attachments (license PDFs, recovery kits)
-
Password history with reveal and one-click restore
-
Per-user favorites and admin-managed category organization
Password Health & Breach Detection
-
HaveIBeenPwned breach check (k-anonymity; team and personal scans; runs in the background)
-
Weak / reused / stale / insecure-URL detection (Security Health engine)
-
0–100 strength scoring shared by the app and the AI agent
-
Crypto-secure password generator with a real-time 4-level strength meter
-
Per-entry expiration with expiring-soon dashboard and email + in-app reminders
AI Password Agent (Ask AI)
-
Password Agent — natural-language retrieve, create, update, archive, restore, and delete
-
Semantic / vector search (finds "WiFi" from "wireless credentials")
-
Respects each user's access permissions in the AI context
-
Confirmation prompt before risky actions; secrets scrubbed from AI logs
-
Admin toggle to enable/disable the agent; honors the 2FA-to-view gate
Security, Encryption & Audit Trail
-
AES-256 (non-deterministic) encryption at rest for passwords, notes, TOTP secrets, and custom fields
-
Require 2FA before any password is viewed (admin toggle)
-
Step-up identity verification ("sudo mode", 15-minute elevated session) before reveal, copy, or CSV export
-
Immutable per-entry audit log (18 action types incl. AI retrievals) with IP/device capture and configurable retention
-
Fail-closed auditing — if the audit row can't be written, the secret is not returned
Import, Export & Migration
-
Import from 1Password, LastPass, Bitwarden, Chrome/Edge, Dashlane, and generic CSV
-
Intelligent paste with AI column mapping and a preview before anything is written (secret values never sent to the LLM)
-
Round-trip CSV export of accessible entries (2FA + step-up gated)
Limits & Specs
-
Item types: 7 (login, secure note, credit card, identity, API credential, bank account, software license)
-
Custom fields per entry: Up to 30 (text, concealed, URL, date)
-
Password history & generator: 20 versions per entry; 16-char default generator (12–64 via the AI agent)
-
External share links: 1 view by default (max 25); 7-day default TTL, 30-day maximum
-
Import size: Up to 500 rows per import
-
Access surfaces & pricing: Web + mobile-optimized app (no browser extension); requires a license
Screenshots
Use cases
FAQ
Passwords, notes, TOTP secrets, and custom-field values are encrypted at rest with Rails application-level AES-256 (non-deterministic) encryption, on top of per-business tenant isolation. Note this is not zero-knowledge — the server holds the keys so the AI agent, TOTP code generation, and breach checks can operate.
Yes. Store a TOTP secret on any login — as a Base32 key or a full otpauth:// QR/setup key — and the entry shows the rolling one-time code with a countdown. Custom digit counts, periods, and algorithms (SHA1/256/512) are honored.
Shared entries can be public (all app users) or restricted to specific groups and people, each granted view or edit — and grants can auto-expire. Admins can limit who may create team passwords, and the access review shows exactly who can read each shared entry.
Admins can require 2FA to view passwords and add step-up identity verification (a 15-minute elevated session) before any reveal, copy, or CSV export. Every reveal is audited fail-closed — if the audit row can't be written, the secret isn't returned.
Only if an admin enables external secure-share links. Each link is tokenized, expiring, and view-limited (one view by default), reveals a single credential on an explicit action, and self-exhausts — safe from link-preview bots.
Beyond logins it stores seven item types: passwords, secure notes, credit cards, identities, API credentials, bank accounts, and software licenses. Typed entries keep their data in concealed custom fields (card number and CVV, license key, account and routing numbers), with up to 30 custom fields per entry and file attachments for things like license PDFs or recovery kits.
Yes. A background Security Health scan flags weak, reused, stale (unchanged for months), and insecure http:// entries and scores each login 0–100. An opt-in breach check uses HaveIBeenPwned with k-anonymity — only the first five characters of a SHA-1 hash ever leave the server, never the password — and reports how many known breaches each password appears in.
Yes. Bulk-import from 1Password, LastPass, Bitwarden, Chrome/Edge, Dashlane, or a generic CSV, up to 500 rows per import. Known formats are matched by their header signature; anything unrecognized (including free-form pasted text) is mapped with AI column detection, and you preview the mapped rows before anything is written. Secret values are never sent to the LLM — only header names and type hints are.
Yes — there is no lock-in. You can export the entries you can access to a CSV whose columns round-trip back through the import flow. Because the file contains plaintext secrets, the web export is step-up gated (an elevated session), and the API export only returns what the requesting user is allowed to view.
No. Password Manager runs in the web app and a mobile-optimized web view — there is no native browser extension, page autofill, or desktop app. You open an entry and copy the password or the current one-time code (each copy is audited). If in-browser autofill is a hard requirement, this app is not the right fit.
