Password vault

The password vault keeps the credentials your team needs, from domain admin accounts to vendor portals, encrypted and audited.

#Add a password

1. Open the organization, then the Passwords tab, and choose + Password.
2. Fill in the name, username and password. Choose Generate for a strong random password, and 👁 to check what you typed.
3. Optionally add a login URL, a category (such as Admin or Vendor portal), notes, and the asset it belongs to.
4. To store a one-time code (TOTP), paste the account's secret key, the Base32 text shown when you set up two-factor on that account (for example JBSWY3DPEHPK3PXP).

#Use a password

On the password's page, or in the Passwords list:

• Show reveals the password on screen.
• Copy copies it without showing it.
• Copy code copies the current one-time code, if a secret is stored.

Passwords linked to an asset also appear on the asset's page with a Copy button.

Note: Every reveal and copy, in the app or through the API, is recorded in the audit log with who, when and from where.

#How passwords are protected

• Secrets and one-time-code keys are encrypted with AES-256-GCM, using a key that's unique to your workspace.
• Password values are never shown in lists or search results, and never sent to Ask AI.
• You can set up an alert for unusual access, such as one person revealing many passwords in a short time. See Notifications and alert rules.

#Who can see passwords

Three permissions control the vault. Admins give them through roles. See Users, roles and teams.

For a password only a few people should see, such as the domain admin account, use per-item access.