# Devolutions Password Hub — Password Management

Devolutions Password Hub by Devolutions Inc. holds a panel rating of 2/5 from 6 AI judges (category median 2.5/5), as of 2026-11-03. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Devolutions Inc. (https://devolutions.net)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/password-management/devolutions-password-hub
- Alternatives: https://whats-best.ai/software/password-management/devolutions-password-hub/alternatives ([markdown](https://whats-best.ai/software/password-management/devolutions-password-hub/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-11-03 · oldest source captured 2026-11-03

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Devolutions Inc.
- Headquarters: Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 3 Nov 2026

## The panel's verdict

Devolutions Password Hub, a password-management product from Devolutions Inc., scores highest on deployment and portability: self-hosting is documented in depth, with Docker images for linux/amd64 and linux/arm64, SQL Server or PostgreSQL 14 or later, high-availability or load-balancing deployment, and customer-supplied TLS certificates. Sharing and access control follows at 4–6, built on vault-level roles that separate View sensitive from View password permissions; identity integration and audit and policy sit at 4–5. The weakest result is pricing transparency, scored 0, with no public information on per-user prices, tiers, seat minimums or terms anywhere captured. The bench genuinely splits on security architecture: low scores weigh the missing encryption detail — no algorithms, key derivation or independent audit are public — while higher scores credit a working disclosure programme, including a YesWeHack bounty paying up to $5,000.00 per issue (USD) for critical vulnerabilities and public advisories with CVEs across at least twelve pages. Sovereignty scores 2–3: self-hosting can remove the vendor from the data path, but residency, the contracting entity, any DPA and subprocessors are unknown, and the vendor states it was proudly founded in Québec, Canada.

**Speaks for it:**
- Self-hosted deployment is documented in depth, with Docker images for linux/amd64 and linux/arm64, SQL Server or PostgreSQL 14 or later, high-availability or load-balancing deployment and customer-supplied TLS certificates.
- Permissions are granular at vault level, with system and vault roles bundling View sensitive, View password, Edit and Manage permissions, user-group assignment, approval workflows, and hidden fields and passwords stated to always respect permissions.
- Sign-in options are concrete — single sign-on with Microsoft Entra ID or Okta, plus physical security keys over USB, NFC on mobile and Windows Hello.
- The disclosure programme is real — a YesWeHack-hosted bounty paying up to $5,000.00 per issue (USD) for critical findings, and public advisories with IDs, CVEs, severities and fix versions across at least twelve pages.
- Administrator reporting is exportable — audit, logs and deleted-entry history, with Azure Log Analytics export, a REST API, webhooks and scheduled JSON or CSV output, plus import from Bitwarden, KeePass, LastPass, 1Password, Google Chrome and Remote Desktop Manager.

**Held against it:**
- No public information names the encryption algorithms, key derivation or which fields are encrypted, and no independent audit or certification is claimed.
- No public information on pricing — no per-user price, tier, seat minimum, add-on or term appears on the captured pages, so no annual cost can be computed (pricing transparency scored 0).
- No public information on admin account recovery, emergency access, time-limited external sharing or what happens to a leaver's shared items.
- Sovereignty is unproven beyond self-hosting — data residency, the contracting entity's jurisdiction, any data-processing agreement and subprocessors are unknown, and the vendor states it was proudly founded in Québec, Canada.

**Best for:**
- You run your own infrastructure and want the vault server self-hosted in Docker, on your own database, certificates and high-availability setup.
- Your team shares credentials where an entry must be usable without its password becoming visible, under approval workflows.
- You are migrating from Bitwarden, KeePass, LastPass, 1Password, Google Chrome or Remote Desktop Manager and need a documented import path with scheduled export.
- Your monitoring already centers on Azure Log Analytics and you need administrator-level audit and logs to flow into it.

**Avoid if:**
- You must see per-user prices, tiers or seat minimums in writing before you can budget a rollout.
- Your security review requires named encryption algorithms, key-derivation details or an independent audit or certification.
- Your procurement process requires a documented contracting entity, data residency, a data-processing agreement or a subprocessor list before purchase.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v2). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 1.5/5 | 1.5/5 | 1/5 | 2/5 | 2/5 | 1/5 |
| Sharing, roles & recovery | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 3/5 | 2/5 |
| SSO, directory sync & provisioning | 2/5 | 2/5 | 2/5 | 2/5 | 2.5/5 | 2/5 |
| Audit logs, policies & reporting | 2/5 | 2/5 | 2/5 | 2/5 | 2.5/5 | 2/5 |
| Hosting choice, offline access & export | 3.5/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 1.5/5 | 1.5/5 | 1/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2/5** | **2/5** | **2/5** | **2.5/5** | **2.5/5** | **2/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Advisories page: public security advisories with advisory ID, severity, product, fix version, CVEs, update date · yes [S5]
- Advisories paging: pagination shows at least 12 pages of advisories [S5]
- Advisory credit: yes [S4]
- Advisory devo 2026 0036: CVE-2026-110806 · CVE-2026-110804 · CVE-2026-110287 · CVE-2026-110805 · Devolutions Server · High · 15/10/2026 · DEVO-2026-0036 · 2026.2.20, 2026.3.10 [S5]
- Advisory devo 2026 0037: CVE-2026-114487 · CVE-2026-114486 · CVE-2026-114485 · Devolutions Server · Medium · 22/10/2026 · DEVO-2026-0037 · 2026.2.21, 2026.3.11 [S5]
- Advisory latest: CVE-2026-116627 · PowerShell Universal · High · 26/10/2026 · DEVO-2026-0038 · 2026.3.1 [S5]
- Bounty channel: In-scope vulnerabilities reported via YesWeHack only [S4]
- Bug bounty access: Invitation-only enrollment [S4]
- Bug bounty critical reward: critical · 5000 [S4]
- Bug bounty host: Bug bounty program hosted on YesWeHack.com [S4]
- Bug bounty scope: Devolutions Server · Remote Desktop Manager (Windows) · Devolutions Gateway · Devolutions Cloud · Devolutions Send · Devolutions Portal and Devolutions Account · Devolutions Crypto · devolutions.net website and blog [S4]
- Security contact: security@devolutions.net for out-of-scope issues [S4]
- Security reporting: Reporting a Security issue · yes [S5]
- Vulnerability scoring: Severity scored using CVSS 3.1 [S4]

**Hosting**
- Docker platforms: Linux · linux/amd64 · linux/arm64 [S13]

**Integrations**
- Azure log analytics: yes [S13]
- Export formats: JSON · CSV · PowerShell script · yes [S12]
- Import formats: CSV · JSON · Bitwarden · KeePass · LastPass · 1Password · Google Chrome · Remote Desktop Manager [S12]
- Rdm web reports: Devolutions Server · Devolutions Cloud · yes [S10]
- Rest API: yes [S13]

**Legal**
- Company origin: Proudly founded in Québec, Canada. Built by experts around the world. [S5]

**Product**
- Affiliation: 21,000+ · no [S3]
- Agent: 25K+ · Windows · Gateway management and PEDM [S2]
- Approval workflows reports: Role assignment often combined with approval workflows and detailed reports [S6]
- Backup caveat: no [S13]
- Bulk operations: bulk install, update, uninstall of multiple packages at once [S3]
- Cloud workspace: 4.9 · 30K+ · Windows · Web · Native workspace for the Devolutions platform [S2]
- Creator: Martí Climent [S3]
- Description: GUI for Windows package managers: install, update, uninstall software without CLI [S3]
- Docker default port: 5000 [S13]
- Docker deployment: SQL Server (including Azure SQL Database) · PostgreSQL [S13]
- Docker modes: Runtime (default) · Initialization (DVLS_INIT=true) · Update (DVLS_UPDATE_MODE=true) [S13]
- Docker prerequisites: 20.10.X [S13]
- Encryption keys: database · schema · first administrator · encryption keys · self-signed HTTPS certificate [S13]
- Export backup: export package lists, import on new machines, share packages [S3]
- Formerly: formerly WingetUI [S3]
- Gateway platforms: 15K+ · Windows · Linux · Docker · Secure remote access — no VPN needed [S2]
- Group based role assignment: Roles assigned through user groups, applied at system or vault level [S6]
- Ha support: yes [S13]
- Hidden fields respect permissions: Hidden fields and passwords always respect permissions [S6]
- Import access control: requires permissions · Help & tools [S12]
- Installation methods: Microsoft Store, winget, scoop, Chocolatey [S3]
- Launcher: 120K+ · Windows · Launch remote sessions from browser [S2]
- Pam platforms: 15K+ · Windows · Linux · Docker · Easy-to-deploy privileged access management built for IT pros [S2]
- Password manager platforms: 350K+ · Windows · macOS · Linux · All-in-one credential and access app [S2]
- Pg client tools: no [S13]
- Platform os support: Windows · macOS · Linux · iOS · Android [S1]
- Platform scope: Single workspace supporting RDP, SSH, VNC and 150+ connection types with automatic credential injection [S1]
- Postgresql requirement: 14 · yes [S13]
- Postgresql superuser only init: no [S13]
- Powershell module: 20K+ · Windows · macOS · Linux · Automate with cmdlets [S2]
- Powershell universal: 40K+ · Windows · macOS · Linux · A unified platform for PowerShell scripting and automation [S2]
- Products listed: Devolutions Remote Desktop Manager · Devolutions PowerShell Universal · Devolutions Password Manager · Devolutions PAM · UniGetUI [S5]
- Rbac roles: RBAC controls visibility/use/management of entries, vaults, and administrative settings [S6]
- Rdm description: RDM centralizes RDP, SSH, VPN and 150+ protocols [S2]
- Rdm installs: 4.7 · 800K+ [S2]
- Rdm platforms: Windows · macOS · Linux · iOS · Android [S2]
- Rdm version: EXE x64 · 2026.3.16.0 [S2]
- Reports admin only: limited [S10]
- Reports capabilities: audit · logs · deleted entries history [S10]
- Schema upgrade control: yes [S13]
- Security key management: yes · deleting security keys from account settings [S8]
- Security key nfc: NFC security key on mobile · yes [S8]
- Security key support: physical security key as password sign-in method · yes [S8]
- Security key usb: USB security key · yes [S8]
- Security key windows hello: Windows Hello · yes [S8]
- Server platforms: 4.5 · 50K+ · Windows · Linux · Docker · Self-hosted workspace for Devolutions RDM [S2]
- Sql collation: Latin1_General_CS_AS [S13]
- SSO providers: Microsoft Entra ID · Okta · Devolutions Account authentication [S9]
- Stats: 140+ · 200+ · 1M+ · 15K+ [S1]
- System vault roles: System and vault roles bundle permissions like View sensitive, View password, Edit, Manage permissions [S6]
- Target platform: Windows 10 and 11 [S3]
- Tls certificate mounting: PEM · self-signed certificate if no files found · yes [S13]
- Unigetui: 4.8 · Windows · macOS · Linux · Graphical interface for package managers [S2]
- Usage stats: 40+ · 90+ · 21,000+ · 300,000+ [S3]
- Webhooks: yes [S13]

## Questions

### Is Devolutions Password Hub European?

Not determined: the vendor’s pages as captured do not say where Devolutions Password Hub is based.

### Where does Devolutions Password Hub store data?

Not stated on the vendor’s pages as of 3 Nov 2026.

### Does Devolutions Password Hub have a free plan?

Not stated on the vendor’s pages as of 3 Nov 2026.

### What are the best alternatives to Devolutions Password Hub?

As of 3 Nov 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Bitwarden (3.5/5)](https://whats-best.ai/software/password-management/bitwarden) and [Proton Pass (3.5/5)](https://whats-best.ai/software/password-management/proton-pass) highest among the other 23 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Devolutions Password Hub alternatives](https://whats-best.ai/software/password-management/devolutions-password-hub/alternatives).

## What this page leaves out

- We could not confirm any pricing information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind.
- 23 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor page: https://devolutions.net (checked 2026-11-03)
- [S2] Self-hosting / on-premises installation docs — found from the homepage: https://devolutions.net/download-center/ (checked 2026-11-03)
- [S3] Open-source licence page — found from the homepage: https://devolutions.net/unigetui/ (checked 2026-11-03)
- [S4] Encryption model & independent audits — found from sitemap: https://devolutions.net/security/ (checked 2026-11-03)
- [S5] Encryption model & independent audits — found from sitemap: https://devolutions.net/security/advisories/ (checked 2026-11-03)
- [S6] Sharing, roles & recovery — found from sitemap: https://docs.devolutions.net/cloud/concepts/advanced-concepts/permissions-rbac-and-roles (checked 2026-11-03)
- [S7] Sharing, roles & recovery — found from sitemap: https://docs.devolutions.net/cloud/knowledge-base/how-to-articles/assign-roles-and-permissions (checked 2026-11-03)
- [S8] SSO, directory sync & provisioning — found from sitemap: https://docs.devolutions.net/portal/sign-in-and-security/security-key-and-passkey (checked 2026-11-03)
- [S9] SSO, directory sync & provisioning — found from sitemap: https://docs.devolutions.net/cloud/getting-started/get-started-with-sso-in-devolutions-cloud (checked 2026-11-03)
- [S10] Audit logs, policies & reporting — found from sitemap: https://docs.devolutions.net/cloud/web-interface/reports (checked 2026-11-03)
- [S11] Audit logs, policies & reporting — found from sitemap: https://docs.devolutions.net/cloud/web-interface/reports/audit (checked 2026-11-03)
- [S12] Hosting choice, offline access & export — found from sitemap: https://docs.devolutions.net/cloud/concepts/basic-concepts/import-and-export (checked 2026-11-03)
- [S13] Hosting choice, offline access & export — found from sitemap: https://docs.devolutions.net/server/knowledge-base/how-to-articles/devolutions-server-docker-deployment (checked 2026-11-03)

---

Cite as: whats-best.ai, "Devolutions Password Hub — Password Management", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/password-management/devolutions-password-hub

Corrections: https://whats-best.ai/correct/1461?target=page