Password Manager App Overview

Password Manager

1. What it is

Password Manager gives your organization a shared vault for team credentials and a private vault for each employee’s own passwords. Entries are encrypted at rest, every access is audit-logged, and a built-in security engine flags weak, reused, or breached passwords.

• Enablement: Password Manager requires a license. An admin enables it from the Apps Marketplace and configures it from the in-app Settings page.
• What it is not: Password Manager stores credentials your people use to sign in to other services. It does not replace your organization’s own single sign-on or authentication settings — those live in Admin → Security & Sign-On.

2. Standing it up

1. Go to Admin → Apps Marketplace, find Password Manager, and enable it.
2. Open Password Manager → Admin → Settings and review the defaults. At a minimum, decide whether employees may store personal passwords (on by default) and whether team passwords are enabled (also on by default).
3. If you want to let non-admin employees create team passwords, choose one or more groups under Who Can Create Team Passwords. Without this, only admins and app admins can create team entries.
4. Optionally, set a Default Password Expiry so new login entries are automatically given a rotation deadline.
5. Default categories (Wi-Fi Networks, Software Licenses, Team Accounts, API Keys, Vendor Portals, Social Media, Banking & Finance, Personal) are seeded automatically the first time someone opens the app. You can add custom categories from Admin → Categories.
6. Confirm the app is working: open Password Manager from the sidebar, create a test entry, and verify it appears in the vault.

3. How it fits together

Entry types

Every record in Password Manager is an entry with a type that determines which fields it carries.

• Password (the default) — a login credential with a username, password, optional URL, and optional one-time-password (TOTP) seed.
• Secure Note — freeform encrypted text with no username or password fields.
• Credit Card, Identity, API Credential, Bank Account, Software License — structured entries whose type-specific fields (card number, account number, license key, etc.) are stored as encrypted custom fields.

An entry’s type is fixed at creation and cannot be changed afterward.

Example: a “Guest WiFi” entry of type Password holds the network name as the title, the SSID as the username, and the passphrase as the password. It is set to Team visibility with Public access so everyone in the organization can look it up. Its expiry is set to 30 days, so the nightly sweep marks it expired and the owner gets a reminder to rotate it.

Personal vs Team

Every entry is either Personal (My Passwords) or Team (Team Passwords).

• Personal entries are private to the owner. No one else — including admins — can see, search, or access them.
• Team entries are visible to other people based on their access level and any per-person sharing grants.

A team entry’s access level is either Public (anyone in the organization with the app enabled can view it) or Restricted (only people or groups explicitly granted access can view it). Group-based access uses the same groups as the rest of MangoApps.

Ownership and sharing

Every entry has an owner — the person who created it. Owners can always view, edit, and delete their entries.

For team entries, the owner or any admin can grant View or Edit access to individual people or groups. Grants can carry an expiry date; a nightly sweep deactivates grants that have lapsed. Admins can also transfer ownership of a team entry to another person.

TOTP (one-time passwords)

Any Password entry can carry a TOTP seed — the same secret a 2FA authenticator app uses. Paste the setup key or the full otpauth:// URI from the site’s QR code, and the entry will generate rolling one-time codes directly on its detail page. Non-standard configurations (digit count, period, algorithm) are preserved from the URI.

Password history

When a login’s password is changed, the previous value is saved automatically. Up to 20 past passwords are kept per entry. Editors can reveal or restore a prior password from the entry’s detail page; every reveal is audit-logged.

Password Agent

When the Enable Password Agent setting is on, employees can look up, create, and rotate credentials through Ask AI in natural language. The agent uses semantic search, so a query like “wireless credentials” can find an entry titled “Guest WiFi”. The agent cannot reveal secrets to anyone who wouldn’t be able to see them through the app.

4. Running it

Reviewing security health (admin)

Go to Password Manager → Admin → Analytics. The Security Health panel analyzes all team login entries and flags:

• Weak passwords — passwords that score below the strength threshold.
• Reused passwords — the same password used on more than one entry.
• Stale passwords — passwords that have not been rotated in 180 days.
• HTTP URLs — entries whose URL uses unencrypted HTTP.

The Analytics page also shows total counts, access statistics for the last 30 days, the most-accessed team entries, and how many entries are expiring within 30 days.

Running a breach check (admin)

From the Analytics page, click Run Breach Check. This sends a background job that checks each team login entry against the HaveIBeenPwned database using k-anonymity (no passwords leave your server in full). Results are cached for 24 hours. The page shows which entries were found in known data breaches and how many times each appeared.

Running a personal breach check

Any user can check their own vault from Password Manager → Security Checkup. This page runs the same security-health analysis (weak, reused, stale, HTTP) on the entries that user owns. A Run Breach Check button triggers a personal breach check that covers both the user’s personal and team-owned entries.

Reviewing who has access (admin)

Go to Password Manager → Admin → Access Review to see every team entry, its allowed groups, its access level, and every person who has been individually granted access. This answers “who can see X?” without opening entries one at a time.

Managing categories

Go to Password Manager → Admin → Categories. Categories organize entries and are visible in the vault’s filter bar. Eight system categories are seeded by default. Admins can add custom categories. A system category cannot be deleted; a custom category can only be deleted when no entries use it.

Importing passwords

Go to Password Manager → Passwords → Import (also accessible from the import icon). Upload a CSV file or paste text. The importer previews parsed rows before committing. Each import can process up to 500 rows. You choose whether imported entries are personal or team, and you can assign a fallback category or let the importer create categories from a column in the source file.

Exporting passwords

From the Passwords list, click Export. This downloads a CSV of every entry the user can access. The export is audit-logged and is gated by the same identity-verification requirements as revealing a single password.

Sharing a credential externally (admin, off by default)

When Allow External Secure-Share Links is turned on in Settings, admins can create a one-time link for a team entry that a non-MangoApps recipient (a vendor, a contractor) can open to see the credential once. Links expire after a set number of days (default 7, maximum 30) and a set number of views (default 1, maximum 25). The link landing page does not reveal the secret until the recipient explicitly clicks Reveal, so link-preview bots do not consume the view. Turning the setting off immediately kills every outstanding link.

Offboarding

When an employee leaves, the offboarding workflow automatically reassigns team entries they owned to their manager (or, if no manager, to a business admin) and deactivates their inbound access grants. Personal entries follow the account’s own lifecycle.

5. Settings

All settings are at Password Manager → Admin → Settings. Only admins and app admins can reach this page.

Setting	Default	What it changes
Enable Password Agent	On	Whether employees can manage credentials through Ask AI.
Allow My Passwords	On	Whether employees can create personal (private) vault entries.
Allow Team Passwords	On	Whether team (shared) entries can be created at all.
Show Password Strength Indicator	On	Whether the strength meter appears on entry forms and detail pages.
Mask Usernames by Default	Off	When on, usernames are masked with dots in search results and list views.
Require 2FA to View Passwords	Off	When on, a user must have two-factor authentication enabled on their account to view any entry. Users without 2FA see a banner and cannot access entry details.
Require Identity Verification to Reveal Passwords	Off	When on, the platform’s step-up verification (the same 15-minute elevation used for sensitive HR data) is required before any password, TOTP code, or concealed custom field is revealed.
Allow External Secure-Share Links	Off	Whether admins can create tokenized one-time links for sharing a team credential with someone outside MangoApps.
Default Password Expiry (Days)	0 (no expiry)	Number of days from creation until a new login entry expires. Entries past their expiry are marked expired by a nightly sweep and the owner receives rotation reminders at 7 days and 1 day before.
Audit Log Retention (Days)	365	How long audit trail records are kept before the nightly cleanup job removes them.
Max Personal Entries Per User	0 (unlimited)	Cap on the number of personal entries a single user may have. Applies at creation and at import; team entries are not counted.
Who Can Create Team Passwords	No groups selected (admins only)	Which employee groups are allowed to create team entries. Admins and app admins can always create team entries regardless of this setting.

6. More help

• Password Manager FAQ — specific questions about limits, troubleshooting, and day-to-day operations.
• Ask AI — the Password Agent answers questions and manages credentials from the AI sidebar.