Find your fit
Who it is for
It fits IT-led teams that need to organize credentials by department or project and control who can read, change or share them. Map one representative credential to its owner and permitted team before importing a whole company vault.
A buyer with infrastructure and residency requirements can compare self-hosting with Passwork Cloud in Germany. Check who operates backups, updates and recovery in the chosen edition; the public deployment descriptions alone do not prove an organization meets a particular security or regulatory obligation.
The work it supports
Core capabilities
Shared vaults and folders organize team credentials. The vendor describes permissions at vault, folder and individual-password level, so a pilot should test whether a staff member can see only the items needed for one real role.
Passwork separates personal and shared vaults. Put company-owned credentials in an appropriately governed shared vault rather than relying on an employee’s personal collection, then confirm transfer of ownership and recovery procedures before broader adoption.
LDAP and Active Directory group synchronization and SAML sign-in are described for identity-led access. Ask which edition and plan provide the required connector, then test a fictional joiner and role change to see when permissions actually update.
The activity guide lists password openings and vault-access changes among logged events. Viewing those events depends on the user’s role and vault access, and the log can be filtered by date, user, action and directory. Confirm retention, export and reviewer permissions against the organization’s audit needs.
Offboarding needs more than blocking a Passwork login. The vendor’s manager guide calls for removing vault access and rotating every credential the departing person could already read; a copied or memorized password can still work until changed. Build that rotation into the handover checklist.
The browser extension is described for vault search, credential creation, password generation and autofill. Test its behavior with a harmless sample site and check device/browser policy before rolling it out to staff.
The Cloud FAQ says CSV and JSON imports are supported. Export a small fictional sample from the old manager, inspect folder structure and access after import, and decide how to handle stale or duplicate records before moving live credentials.
Understand the offer
Pricing and getting started
The viewed Cloud page lists Standard for shared vaults, SSO and audit logs, and Advanced for additional secrets and development-workflow tools. Its FAQ quotes starting prices of 3 euros and 4.50 euros per user per month respectively. Confirm seat minimums, billing term, currency, tax and actual plan rights for the buyer’s market.
The Cloud page advertises a free seven-day trial. The self-hosted homepage separately advertises one month. Check which trial applies to the chosen deployment and what happens to access and data when it ends.
Self-hosted Standard and Advanced are described with an initial one-year subscription; the homepage says a further subscription should be bought after that period. A separate Lifetime offer is quote-led. Ask for a written breakdown of license, support, updates, hosting and renewal terms before comparing its cost with Cloud.
Look a little closer
Before you choose
Evaluate with fictional credentials: create one shared vault, assign two different groups, verify each view, open a sample record, change access and inspect the activity trail. Repeat the check after a simulated departure and document which underlying passwords must be rotated.
Before importing real secrets, settle the deployment, identity connector, admin roles, export/recovery path and commercial terms. Vendor statements about compliance or security outcomes are not a substitute for testing the organization’s own configuration and obligations.
6 distinct sources behind this profile. Research observed Oct 21, 2026. Features and offers can change.
View sources and research →
