Password Manager FAQ
Answers to common setup and operating questions about Password Manager.
For what the app is and how to set it up from scratch, see the
Password Manager Overview.
Setup
Do I need to configure anything before my team can use it?
Password Manager works out of the box once it is enabled and licensed. Both personal (My Passwords) and team passwords are on by default. The Password Agent is also on by default, and entry encryption is automatic. The only features that require an admin to opt in are Require 2FA to View Passwords, Require Identity Verification to Reveal Passwords, and Allow External Secure-Share Links — all three are off by default. You will find all of these under Settings in the admin sidebar.
Who can access admin settings, analytics, and access review?
Any user who is an Admin or above for the organization, or who has been designated an App Admin for Password Manager. These roles see the Admin section in the sidebar, which contains Categories, Analytics, Access Review, and Settings.
Permissions and access
Who can create team passwords?
Admins and App Admins can always create team passwords. For other users, the admin must specify which groups are allowed under Settings → Who Can Create Team Passwords. If no groups are selected, only admins can create them. Users who belong to at least one of the selected groups will see the Team option when creating an entry.
Why can’t some employees see certain team passwords?
Team passwords have an access level. Public entries are visible to everyone who has access to the app. Restricted entries are visible only to group members listed in the entry’s allowed groups, people with a direct per-person access grant, and admins. If an employee can’t see a restricted entry, either their group isn’t in the allowed list or they haven’t been granted individual access. Check the entry’s sharing panel or use the Access Review page to see exactly who can read it.
Day-to-day
How does the built-in 2FA authenticator work?
Store a TOTP secret on any login entry — either paste a Base32 key or paste a full otpauth:// setup URI from a QR code. The entry will then show a rolling one-time code with a countdown timer. Custom digit counts (6–8), periods (15–300 seconds), and algorithms (SHA1, SHA256, SHA512) from the setup URI are honored automatically. Every code view is audited.
What happens when I rotate a password — is the old one kept?
Yes. Each time a login’s password is changed, the previous value is captured automatically into the password history. The app keeps the last 20 versions per entry. Users with edit access can view and restore any prior version — both actions are audited separately.
How do I share a credential with someone outside the company?
An admin must first enable Allow External Secure-Share Links in Settings. Once enabled, admins can create a tokenized, expiring link on any team entry they manage. Each link has a time-to-live (default 7 days, maximum 30 days) and a view limit (default 1 view, maximum 25 views). The link lands on a page that does not reveal the secret until the recipient clicks an explicit Reveal button, so email and chat link-preview bots never consume the view. The link self-exhausts once all views are used or the expiry passes, and an admin can revoke it at any time.
What happens to someone’s passwords when they leave the organization?
When someone is offboarded, Password Manager automatically reassigns every team password they owned to their manager — or to an admin if their manager is not an active member. It also deactivates all of their inbound per-person access grants. Personal passwords are not touched and follow the account’s own lifecycle.
When something looks wrong
“I can’t see the password — it says I need to verify my identity”
This means your admin has turned on Require Identity Verification to Reveal Passwords. You need to complete a step-up verification (a 15-minute elevated session) before any password, TOTP code, concealed field, or password-history entry is returned. Verify once and you can reveal secrets for the next 15 minutes without re-verifying.
“The app says I need 2FA enabled to view passwords”
Your admin has turned on Require 2FA to View Passwords. You need to enable two-factor authentication on your own account in your security settings before you can view, copy, export, or retrieve any password — including through the AI agent and the one-time code widget. The app shows a banner on every list and entry page until you enable it.
“I can’t create a new password — it says I’ve reached the limit”
Your admin has set a per-user cap on personal passwords under Settings → Max Personal Entries Per User. The default is unlimited (0 means no cap). If a cap is set and you have reached it, you can archive entries you no longer need to free up space — archived entries don’t count against the cap. Contact your admin if you need the limit raised.
“I imported my CSV but some rows say ‘duplicate’”
The import preview compares each row’s title and username (case-insensitive) against your existing entries. If a match is found, the row is marked Duplicate and skipped to avoid creating a second copy. If you genuinely want to re-import, rename or delete the existing entry first.
Security and auditing
How are secrets encrypted?
Passwords, notes, TOTP secrets, and concealed custom-field values are encrypted at rest using AES-256 non-deterministic encryption at the application layer, on top of per-business tenant isolation. This is not zero-knowledge — the server holds the keys so the AI agent, TOTP code generation, and breach checks can operate on the stored values.
How does the breach check work?
The breach check uses the HaveIBeenPwned Pwned Passwords API with k-anonymity: only the first five characters of a SHA-1 hash are sent to the service — the password itself, and even its full hash, never leave the server. The team breach check (admin-initiated from Analytics) scans all shared entries. Each user can also run a personal breach check from the Security Checkup page, which covers every entry they own. Results are cached for 24 hours. A lock prevents a second check from starting while one is already running.
What gets logged in the audit trail?
Every interaction with a secret is recorded: view, copy, reveal of concealed fields, TOTP code view, password-history view, password-history restore, create, update, delete, archive, restore, expiry, access grant, access revoke, AI retrieval, AI password view, attachment add, and attachment remove — 18 action types in total. Each audit row captures the user, timestamp, IP address, and device. On the web app, secret-returning endpoints are fail-closed: if the audit row cannot be written, the secret is not returned. Audit logs are retained for the number of days configured in Settings (default 365 days, minimum 30 days), and a nightly cleanup removes rows past the retention window.
Limits
What are the limits I should know about?
| What | Limit |
|---|---|
| Entry types | 7 (login, secure note, credit card, identity, API credential, bank account, software license) |
| Custom fields per entry | 30 (text, concealed, URL, or date) |
| Password history per entry | 20 versions |
| Import size | 500 rows per import (CSV file max 1 MB) |
| External share-link views | 1 by default, up to 25 |
| External share-link TTL | 7 days by default, 30-day maximum |
| Bulk action (archive/categorize) | 100 entries at a time |
| Security Checkup scan | 200 most-recently-updated entries |
| Password generator default | 16 characters in the app, 12–64 via the AI agent |
| Stale-password threshold | 180 days since the password was last rotated |
| Weak-password threshold | Score below 60 out of 100 |
| Audit log retention | Configurable, default 365 days (minimum 30) |
| Max personal entries per user | Configurable, default unlimited |
| TOTP digit count | 6–8 |
| TOTP period | 15–300 seconds |
Does Password Manager require a license?
Yes. Password Manager requires a license and is disabled by default. An admin enables it from the Apps Marketplace, and it becomes available to users with app access.
More help
- Password Manager Overview
- Ask AI — the Password Agent answers Password Manager questions from these articles and can retrieve, create, rotate, and search credentials by natural language.