# PassCamp — Password Management

PassCamp by PassCamp holds a panel rating of 1.5/5 from 6 AI judges (category median 2/5), as of 2026-10-21. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: PassCamp (https://passcamp.com)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/password-management/passcamp
- Alternatives: https://whats-best.ai/software/password-management/passcamp/alternatives ([markdown](https://whats-best.ai/software/password-management/passcamp/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-21 · oldest source captured 2026-10-20

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: PassCamp
- Headquarters: Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting: Default not stated; pages mention the EU [S2]
- Free plan: Not stated on the vendor’s pages as of 20 Oct 2026

## The panel's verdict

PassCamp is a cloud-based password manager from UAB PassCamp, a Lithuanian company; the vendor places vault data on Google Cloud Platform in Belgium and hosts support and email services primarily in Lithuania. The bench scored it strongest on deployment and portability and on sharing and access control, both clustering at 4: per-item sharing with view, edit and share permissions, an immutable history log, export at any time, and a read-only frozen state of not less than six months after payment stops. Its weakest area is identity integration, 0 to 1 — the only documented second factor is a code sent to a separate device, and we found no public information on single sign-on, directory sync or hardware keys. Audit and policy scored 2 to 3, the per-item history log standing alone with no public information on exportable logs or enforceable policies. Security architecture scored 3 to 4: AES-256, RSA-4096 and SRP 6A are named, but we found no public information on independent audits. Sovereignty spread widest, 4 to 6, over unknown ownership and subprocessor exposure. Pricing transparency sits at 0.

**Speaks for it:**
- Per-item sharing with view, edit and share permissions, recorded in an immutable history log of edits, shares, modification dates and old versions
- Export available at any time, with a read-only frozen state of not less than six months after payment stops to retrieve data
- A disclosed European chain on the vendor's own pages — UAB PassCamp of Kaunas, Lithuania, vault data on Google Cloud Platform in Belgium, support and email services hosted primarily in Lithuania
- A Kubernetes-based platform the vendor says runs on self-hosted instances under enterprise licensing, alongside web, browser-extension and Android/iOS apps
- Named algorithms — AES-256, RSA-4096, SRP 6A — plus a privacy policy that openly lists staff-visible service data such as server logs, billing information, client IP addresses and email addresses

**Held against it:**
- We found no public information on single sign-on, directory sync or provisioning, and the only second factor described is a code sent to a separate device
- We found no public information on exportable admin event logs, enforceable master-password or MFA policies, password health or breach reports, or SIEM integration
- We found no public information on independent audits, penetration tests, a bug bounty or incident history, and the white paper is referenced but not shown
- Sharing requires every recipient to hold a PassCamp account, and we found no public information on shared vaults, admin roles, admin account recovery, emergency access or reclaiming a leaver's items
- We found no public information on ownership, a subprocessor list with locations, a data-processing agreement covering metadata and logs, or certifications, and independent sovereignty checks return unknowns

**Best for:**
- You need per-item credential sharing with view, edit and share permissions and an immutable record of every change, in a team where recipients all hold accounts
- Your procurement asks for a European contracting entity and vault data the vendor states is held on servers within the European Union — UAB PassCamp in Lithuania, Google Cloud Platform in Belgium
- You want a licensed, self-hostable option on the table for enterprise deployment rather than cloud service alone
- You put exit terms first — export at any time plus a read-only frozen state of not less than six months after payment stops

**Avoid if:**
- Your team signs in through a corporate identity provider — identity integration scored 0 to 1, and the only documented second factor is a code sent to a separate device
- You must satisfy an ISO 27001 or NIS2 audit — audit and policy scored 2 to 3, and we found no public information on exportable event logs or enforceable policies
- You require third-party verification before adoption — security architecture scored 3 to 4, and we found no public information on independent audits or penetration tests
- You need admin account recovery, emergency access or a way to reclaim a departing employee's shared items — we found no public information on any of these

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 1.5/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Sharing, roles & recovery | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| SSO, directory sync & provisioning | 0.5/5 | 0.5/5 | 0.5/5 | 0/5 | 0/5 | 0/5 |
| Audit logs, policies & reporting | 1/5 | 1/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1/5 |
| Hosting choice, offline access & export | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 2/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 | 2/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **1.5/5** | **1.5/5** | **2/5** | **2/5** | **2/5** | **1.5/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Breach notification: without undue delay · yes [S2]
- No cross service tracking: no [S2]
- White paper: yes [S3]
- White paper: yes [S4]

**Data**
- Erasure SLA: 72 [S2]
- Export availability: yes [S2]
- Frozen state: 6 [S2]
- Underage minimum age: 16 [S2]

**Hosting**
- Data center security: daily · 24/7 [S3]
- Data location: EU [S2]
- Datacenter security: daily · 24/7 [S4]
- Kubernetes self hosted: Kubernetes · yes [S1]
- Provider: Belgium · Google Cloud Platform [S3]
- Provider: Belgium · Google Cloud Platform [S4]
- Tls: yes [S3]

**Legal**
- Entity: UAB PassCamp · Savanorių pr. 178, LT-44150 Kaunas, Lithuania · Lithuania [S2]
- Policy updated: 2020-04-20 [S2]

**Product**
- Account required for sharing: yes [S5]
- Auth srp6a: SRP 6A [S3]
- Cloud based: yes [S3]
- Diagnostic data optional: yes [S2]
- Encrypted disclosure: yes [S2]
- Encryption aes256: symmetric · AES-256 [S3]
- Encryption aes256: symmetric · AES-256 [S4]
- Encryption rsa4096: asymmetric · RSA-4096 [S3]
- Encryption rsa4096: asymmetric · RSA-4096 [S4]
- Encryption zero knowledge: yes [S3]
- Enterprise licensed software: Enterprise licensed software, integrable into existing software suite, bundled with other products or hosted standalone [S1]
- History logs: edits · shares · modification dates · old versions · yes [S5]
- History tracking: yes [S3]
- History tracking: yes · centralized blockchain [S4]
- Master password: Master Password unlocks private key used to decrypt data [S3]
- Master password: Master Password unlocks private key which decrypts data [S4]
- Multi platform sync: web app · browser extension · Android/iOS mobile app · yes [S1]
- Permission control: yes [S3]
- Permission control: yes [S4]
- Rsa encryption: RSA asymmetric encryption: passwords encrypted with public key, decrypted with private user key [S5]
- Secure data zero knowledge: yes [S2]
- Secure sharing: yes · RSA [S3]
- Secure sharing: yes · RSA asymmetric encryption [S4]
- Service data scope: server logs · billing information · client IP addresses · number of accounts · company or family name · email addresses · yes [S2]
- Share permissions: multi-tier sharing supported [S5]
- Srp auth: SRP 6A [S4]
- Transport encryption: TLS [S4]
- Two factor: yes [S3]
- Two factor auth: yes [S4]
- Vault architecture: Every individual item has its own vault, which can be managed, shared and tracked [S1]
- White label: Rebranded password management system [S1]
- Zero knowledge: yes [S4]

**Support**
- Hosting location: Lithuania [S2]

## Questions

### Is PassCamp European?

Not determined: the vendor’s pages as captured do not say where PassCamp is based.

### Where does PassCamp store data?

The default storage location for customer data is not stated on the vendor’s pages as of 20 Oct 2026. The vendor’s pages mention the EU as hosting location, per [the vendor’s page captured 20 Oct 2026](https://whats-best.ai/evidence/9624).

### Does PassCamp have a free plan?

Not stated on the vendor’s pages as of 20 Oct 2026.

### What are the best alternatives to PassCamp?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [PassCamp alternatives](https://whats-best.ai/software/password-management/passcamp/alternatives).

## What this page leaves out

- We found no public information on pricing on the pages we read (passcamp.com, passcamp.com/passcamp-privacy-policy, passcamp.com/security, passcamp.com/secure-password-sharing). If the vendor publishes it somewhere else, send us the page.
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor page: https://passcamp.com (checked 2026-10-20)
- [S2] Privacy policy — found from the homepage: https://passcamp.com/passcamp-privacy-policy/ (checked 2026-10-20)
- [S3] Security / trust page — found from the homepage: https://passcamp.com/security/ (checked 2026-10-20)
- [S4] Encryption model & independent audits — found from sitemap: https://www.passcamp.com/security/ (checked 2026-10-20)
- [S5] Sharing, roles & recovery — found from sitemap: https://www.passcamp.com/secure-password-sharing/ (checked 2026-10-20)

---

Cite as: whats-best.ai, "PassCamp — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/passcamp

Corrections: https://whats-best.ai/correct/930?target=page