# heylogin — Password Management

heylogin by heylogin GmbH holds a panel rating of 2.5/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: EU-Made; sovereignty: not determined.

- Vendor: heylogin GmbH (https://www.heylogin.com/de)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/password-management/heylogin
- Alternatives: https://whats-best.ai/software/password-management/heylogin/alternatives ([markdown](https://whats-best.ai/software/password-management/heylogin/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: heylogin GmbH
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

heylogin is a business password manager without a master password from heylogin GmbH, presented as developed in Germany and hosted by EU cloud providers. It is strongest on sharing and access control (5 to 6) and identity integration (5 to 6): teams with admin and custom roles, sending and receiving passwords externally, hidden passwords, cryptographic admin recovery, and Entra groups mirroring as heylogin teams with membership kept current, alongside Google Workspace sync. Security architecture and audit and policy both score 4: named cryptography (XSalsa20 with Poly1305, Curve25519) and a security whitepaper, but we found no public information on independent audits or certifications; the audit log records website logins, password copies and reveals for one year, yet sits in the Enterprise plan behind sales@heylogin.com. Sovereignty is the widest split (4 to 6): higher scores credit named German infrastructure — Hetzner in Nuremberg, a Falkenstein standby, IONOS backups — while the lowest notes contracting entity, ownership, residency and subprocessor exposure unconfirmed on the captured pages. Pricing transparency is weakest at 1 to 2: no price figure appears on the captured pages.

**Speaks for it:**
- Team sharing scored 5 to 6, with teams, admin and custom roles, external password send and receive, hidden passwords and cryptographic admin recovery documented
- Entra groups mirror as heylogin teams with membership kept current and shared access driven by existing groups, with Google Workspace sync also available
- Cryptography is named (XSalsa20 with Poly1305, Curve25519), detailed in a security whitepaper, with a cloud stated to store data only and not decrypt vaults
- Breach detection notifies the administrator automatically when a password is compromised
- Importers cover ten named password managers plus CSV and Excel, with export through the settings where the data is selectable

**Held against it:**
- No price figure appears on the captured pages, and the audit log and custom roles sit in the Enterprise plan behind sales@heylogin.com (pricing transparency scored 1 to 2)
- We found no public information on independent audits, certifications, penetration tests or a bug bounty
- The audit log is Enterprise-only with login and user changes announced as upcoming, and we found no public information on log export, SIEM integration or enforceable policies
- We found no public information on SSO sign-in, SCIM or automated suspension on deprovisioning, and the captured pages do not tie an identity login to vault decryption
- The on-premises option for organisations with more than 300 employees duplicates encrypted data rather than enabling self-hosting, and we found no public information on offline access or a Linux client

**Best for:**
- You run Microsoft Entra ID and want directory groups to mirror as teams that automatically drive shared access
- You share logins across teams and need custom roles, hidden passwords and cryptographic admin recovery while admins stay locked out of personal vaults
- You want a no-master-password unlock using a smartphone, FIDO2 security key, Touch ID, Windows Hello or smartwatch
- You are migrating from another password manager and need importers plus a settings-based export with selectable data

**Avoid if:**
- You need to compute an annual cost before talking to sales — ask the vendor: the public pages we read do not show it
- You must run the vault on your own servers — the captured pages show vendor cloud hosting, and the on-premises option for organisations with more than 300 employees duplicates encrypted data rather than enabling self-hosting
- You need audit logging without an Enterprise contract — the audit log is available only in the Enterprise plan, and events for login and user changes are still announced as upcoming

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Sharing, roles & recovery | 3/5 | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 |
| SSO, directory sync & provisioning | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 |
| Audit logs, policies & reporting | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Hosting choice, offline access & export | 2.5/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 2/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 |
| Pricing transparency | 0.5/5 | 1/5 | 0.5/5 | 1/5 | 0.5/5 | 0.5/5 |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2/5** | **2.5/5** | **2.5/5** | **2/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Automated decision making: no [S3]
- GDPR: Germany · yes [S1]
- GDPR: yes · yes [S5]
- GDPR: yes · yes [S6]
- ISO 27001: yes · heylogin GmbH [S1]
- ISO 27001: ISMS · ISO 27001:2022 · yes [S5]
- ISO 27001: ISO 27001:2022 · yes [S6]
- Public sector: strikter Auftragsverarbeitungsvertrag mit europäischen Unterauftragsverarbeitern · Städte, Gemeinden, Behörden · yes [S2]
- Retention: 10 [S3]
- Toms: https://www.heylogin.com/de/toms · yes [S3]
- Trust center: security architecture · trust center · data protection [S1]
- US transfer: EU-US adequacy decision 2023-07-10, Art. 45 GDPR + DPF certification [S3]

**Data**
- Audit log retention: 1 year [S11]
- Audit log retention: 1 year [S12]
- Audit log scope: Only logs events within the specific organization [S11]
- Export: yes [S3]
- Export location: heylogin.app export area [S14]
- Export steps: yes · yes [S14]

**Hosting**
- Backup provider: IONOS [S5]
- Made in europe: Made in Europe [S2]
- Provider regions: Hetzner · Falkenstein · Nuremberg [S5]
- Providers locations: Production at Hetzner Nuremberg, standby in Falkenstein, independent backups at IONOS [S6]
- Residency: EU cloud providers · Germany [S1]

**Integrations**
- API: yes [S1]
- App downloads: Google Chrome · Mozilla Firefox · Safari · Microsoft Edge [S1]
- Browser extensions: Google Chrome · Mozilla Firefox · Safari · Microsoft Edge [S2]
- Browser extensions: Google Chrome · Mozilla Firefox · Safari · Microsoft Edge [S5]
- Browser extensions: Google Chrome · Mozilla Firefox · Safari · Microsoft Edge [S6]
- Customer control: yes [S3]
- Entra id admin consent: yes · yes [S9]
- Entra id capabilities: yes · yes [S9]
- Entra id employee activation: Employees can be activated from Microsoft Entra ID [S9]
- Entra id group team sync: Entra groups sync as heylogin teams; membership kept in sync automatically [S9]
- Entra id required permissions: User.Read.All · Group.Read.All [S9]
- Google workspace available: yes [S9]
- Microsoft entra id available: yes [S9]

**Legal**
- Address: 38118 · Braunschweig · Sophienstr. 40 · Germany [S4]
- Company location: Braunschweig · heylogin GmbH [S5]
- Company name: heylogin GmbH [S4]
- Content responsible: Dr. Dominik Schürmann [S4]
- Controller: heylogin GmbH · Sophienstr. 40, 38118 Braunschweig [S3]
- Headquarters: Braunschweig · heylogin GmbH [S6]
- Privacy update date: 2026-06-16 [S3]
- Register: Amtsgericht Braunschweig · HRB 207299 [S4]
- Separate marketing privacy: yes [S3]
- Trademark: yes [S4]
- Trademark: yes · yes [S7]
- VAT id: DE319442503 [S4]

**Pricing**
- Business features: Alle Funktionen von Privat; Nutzer-Verwaltung; Team-Verwaltung; Vordefinierte Rollen; Support per E-Mail [S2]
- Business price: EUR · 3.99 · yes · annual [S2]
- Enterprise features: Alle Funktionen von Business; Benutzerdefinierte Rollen (RBAC); Audit log; Pwnitoring - Data Breach Monitoring; Onboarding-Betreuung (optional); On-Premises Backup (optional); Support per Telefon [S2]
- Nonprofit discount: Sonderkonditionen für Non-Profit-Organisationen verfügbar; Rabatte nach individueller Prüfung [S2]
- Private features: Passwörter generieren und speichern; Bestätigen mit Smartphone; Bestätigen mit Sicherheitsschlüssel (FIDO2), Touch ID oder Windows Hello; 2-Faktor-Automatisierung (TOTP); Passkey-Support; Bearbeitungsverlauf und Papierkorb [S2]
- Private plan: Privat · yes · 0 [S2]
- VAT note: Alle Preise zzgl. MwSt. [S2]

**Product**
- Admin recovery encryption: no · yes [S5]
- Admin role permissions: Management von Logins und Teams; Verändern der Grundeinstellungen; Hinzufügen und Entfernen von Mitarbeitenden; Weitere Admins benennen [S7]
- Audit log events: Performing a website login with heylogin · Copying a password · Clicking show on a password · Clicking show on other fields configured as hidden [S11]
- Audit log events hidden field reveal: yes [S12]
- Audit log events password copy: yes [S12]
- Audit log events password reveal: yes [S12]
- Audit log events website login: yes [S12]
- Audit log plan: Enterprise Plan · sales@heylogin.com [S11]
- Audit log planned events: Login-Änderungen · Änderungen im Zusammenhang mit Benutzern [S12]
- Audit log purpose: Admins can observe employee usage of logins [S11]
- Audit log purpose: Admins können die Nutzung von Logins durch Mitarbeiter überprüfen [S12]
- Audit log upcoming events: When a login has been modified · User-related changes [S11]
- B2b model: B2B · Mozilla Ventures · no [S1]
- Breach detection: yes [S1]
- Browser extension: Chrome · Firefox · Safari · Edge [S1]
- Browser extensions: Google Chrome · Mozilla Firefox · Safari · Microsoft Edge [S7]
- Cloud storage only: no [S5]
- Cookies: yes [S3]
- Crypto algorithms: XSalsa20 · Poly1305 · Curve25519 [S5]
- Crypto algorithms: XSalsa20 · Poly1305 · Curve25519 [S6]
- Custom role permissions: Individuelle Berechtigungen pro Rolle; namentliches Benennen; unbegrenzte Anpassung durch Admin [S7]
- Custom roles rbac: Enterprise · yes [S7]
- Default 2FA: yes · yes [S6]
- Device security chip encryption: device security chips [S5]
- Encryption: yes · yes · yes [S1]
- Encryption: yes [S3]
- Enterprise addons large orgs: Persönlicher Customer Success Manager; Betreutes Onboarding; Initiale Einrichtung Ihrer Unternehmensstruktur; Integration in Ihre Sicherheitsrichtlinien (ISMS); On-Premises Backup [S2]
- Entra admin consent required: privileged Entra user · yes [S10]
- Entra group sync: Entra groups sync as heylogin Teams; membership changes in Entra are automatically reflected in the heylogin team [S10]
- Entra id integration: Microsoft Entra ID integration allows importing users and controlling shared access automatically via existing Entra groups [S10]
- Entra permission group read all: access list of groups in the organization · Group.Read.All [S10]
- Entra permission user read all: access list of users in the organization (username + email address) · User.Read.All [S10]
- Entra related integrations: Microsoft Entra ID · Google Workspace · Windows Deployment [S10]
- Hibp integration: Superlative Enterprises Pty Ltd · Have I Been Pwned – Leak-Check per Domain-Verifikation · Australien · no [S3]
- Import browsers: Google Chrome · Microsoft Edge · Mozilla Firefox [S13]
- Import generic formats: Excel · CSV [S13]
- Import history feature: Import history · Troubleshooting [S13]
- Import password managers: 1Password · Apple Passwords · Bitwarden · Dashlane · Enpass · heylogin · KeePass · LastPass · NordPass · Proton Pass · Sticky Password [S13]
- Import source: Step-by-step guides to import logins via importers on heylogin.app [S13]
- Login devices: iOS app · Android app · FIDO2 security keys · Touch ID · Windows Hello · smartwatches [S1]
- No master password: no [S1]
- No vendor access: no [S5]
- Onboarding: email invite · Microsoft Entra ID sync · Google Workspace sync · manual start code [S1]
- Overall rating: 07/26 · 1238 · 4.7 [S1]
- Pc mac connect: PC/Mac verbinden [S2]
- Rating: 07/26 · 1238 · 4.7 [S7]
- Ratings: 4.8 · 4.6 · 4.9 [S1]
- Role modification: verändern · deaktivieren · entfernen · yes [S7]
- Role types: Nutzer · Admin · Benutzerdefiniert · Enterprise [S7]
- Role visibility counts: yes [S7]
- Scope: Android/iOS apps · Extensions · Web app heylogin.app [S3]
- Second factor unlock: fingerprint · face unlock · PIN [S5]
- Security whitepaper: Security Whitepaper · yes [S5]
- Share logins subtopics: Share logins [S8]
- Supported authenticators: Smartphone · Security Key · Touch ID / Windows Hello · Smartwatch [S5]
- Supported unlock devices: Smartphone, security keys, Touch ID / Windows Hello, smartwatch [S6]
- Sync cloud: Vaults auto-synced via streaming connection; cloud stores data only and cannot decrypt vaults [S6]
- Team sharing: team password assignment/sharing supported [S1]
- Totp autofill: yes [S1]
- Trial: Business · yes [S2]
- Two factor default: yes [S5]
- Unlock mechanism: Security chip unlocked locally by second factor: fingerprint, Face-Unlock, PIN; key seed provided e2e-encrypted, then discarded [S6]
- User role permissions: Zugriff auf freigegebene Logins; Anlegen und Verwalten persönlicher Logins; Agieren innerhalb von zugeteilten Teams [S7]
- Vault separation: yes [S5]
- Vault separation: Strictly separated vaults per user device; admins cannot access personal vaults; org vaults also encrypted with admin security chips enabling recovery [S6]
- Zero knowledge: yes · 60 [S1]
- Zero knowledge: Zero-knowledge architecture with end-to-end encryption [S5]
- Zero knowledge e2e: yes · yes [S6]

**Support**
- Channels enterprise: phone [S2]
- Help center: contact · help center · system status [S1]
- Sales contact: sales@heylogin.com [S2]
- Security contact: Information Security Officer · security@heylogin.com [S5]
- Security contact: Informationssicherheitsbeauftragter (ISB) · security@heylogin.com [S6]
- Whitepaper: Security Whitepaper available for download with cryptographic details [S6]

## Questions

### Is heylogin European?

Yes. whats-best.ai classifies heylogin as EU-Made.

### Where does heylogin store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does heylogin have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to heylogin?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [heylogin alternatives](https://whats-best.ai/software/password-management/heylogin/alternatives).

## What this page leaves out

- 9 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.heylogin.com/de (checked 2026-10-13)
- [S2] Pricing page: https://www.heylogin.com/de/preise (checked 2026-10-13)
- [S3] Privacy policy: https://www.heylogin.com/de/datenschutz (checked 2026-10-13)
- [S4] Legal notice: https://www.heylogin.com/de/impressum (checked 2026-10-13)
- [S5] Encryption model & independent audits — found from sitemap: https://www.heylogin.com/en/security-architecture (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://www.heylogin.com/de/sicherheitsarchitektur (checked 2026-10-13)
- [S7] Sharing, roles & recovery — found from sitemap: https://www.heylogin.com/de/rollen (checked 2026-10-13)
- [S8] Sharing, roles & recovery — found from sitemap: https://help.heylogin.com/en/organizations/share-logins (checked 2026-10-13)
- [S9] SSO, directory sync & provisioning — found from sitemap: https://help.heylogin.com/en/organizations/integrations/microsoft-entra-id (checked 2026-10-13)
- [S10] SSO, directory sync & provisioning — found from sitemap: https://help.heylogin.com/de/organisationen/integrationen/microsoft-entra-id (checked 2026-10-13)
- [S11] Audit logs, policies & reporting — found from sitemap: https://help.heylogin.com/en/organizations/manage-organizations/audit-log (checked 2026-10-13)
- [S12] Audit logs, policies & reporting — found from sitemap: https://help.heylogin.com/de/organisationen/organisationen-verwalten/audit-log (checked 2026-10-13)
- [S13] Hosting choice, offline access & export — found from sitemap: https://help.heylogin.com/en/welcome/import-and-export/import (checked 2026-10-13)
- [S14] Hosting choice, offline access & export — found from sitemap: https://help.heylogin.com/en/welcome/import-and-export/export (checked 2026-10-13)

---

Cite as: whats-best.ai, "heylogin — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/heylogin

Corrections: https://whats-best.ai/correct/663?target=page