# Password Depot — Password Management

Password Depot by AceBIT GmbH holds a panel rating of 3.5/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: EU-Made; sovereignty: not determined.

- Vendor: AceBIT GmbH (https://www.password-depot.de/de/)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/password-management/password-depot
- Alternatives: https://whats-best.ai/software/password-management/password-depot/alternatives ([markdown](https://whats-best.ai/software/password-management/password-depot/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: AceBIT GmbH
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Password Depot Business, developed by AceBIT GmbH in Darmstadt since 1998, is strongest on deployment and portability, scoring 7-8, and on sharing and access control at 6-8: databases run on-premises, in your own Azure tenant or fully local with no vendor cloud in the chain of trust, and server-side permissions reach from whole databases down to individual entries with approval-gated seals and time-limited access. Identity integration and audit and policy each landed at 7 with no spread. The judges split on security architecture, 4-6: the cryptography is published in detail — AES-256 in the AES-GCM default mode, Argon2id parameters, PBKDF2 at 600,000 iterations, TLS 1.3 — while the SySS penetration test is named without a date or published report, and the judges weighed these facts differently. Sovereignty clusters at 6-7: German development and support are documented, but independently collected facts on legal entity, ownership, residency and subprocessors came back unknown, and no certification such as ISO 27001 or BSI C5 is published. Weighted totals span 6.2 to 7.0; no price is public — ordering ends in an individual quote by email.

**Speaks for it:**
- Databases run on-premises, in your own Azure tenant or fully local with no vendor cloud in the chain of trust, and mirror servers and automated backups are documented
- Server-side permissions reach from whole databases down to individual entries and folders, with time-limited access dates, approval-gated sealed entries and link sharing over HTTPS
- Cryptography is published in detail: AES-256 in the AES-GCM default mode, Argon2id parameters, PBKDF2 at 600,000 iterations and TLS 1.3
- Directory integration spans Active Directory and Microsoft Entra ID sync, Kerberos and OpenID Connect sign-on, SCIM provisioning and FIDO2/WebAuthn MFA, with the server documented as never storing directory passwords
- Export covers XML, CSV, TXT, HTML and an encrypted PSWE database format behind master-password authentication, and the web client's source is public

**Held against it:**
- The SySS penetration test is named without a date or published report, and only the web client's source is public
- No certification such as ISO 27001, SOC 2 or BSI C5 is published, and independently collected facts on ownership, residency and subprocessors came back unknown
- We found no public information on emergency access with a waiting period, or on an administrator recovery mechanism and its key model
- We found no stated log-retention period, and the available reports cover users, databases, groups and members rather than compliance mappings to ISO 27001 or NIS2
- No price figure is public — ordering runs through an individual, non-binding quote by email and a DocuSign signature

**Best for:**
- You need the vault on infrastructure you control — an on-premises Enterprise Server, your own Azure tenant or fully local databases — with no vendor cloud in the chain of trust
- Your team runs on Active Directory or Microsoft Entra ID and wants SCIM provisioning, Kerberos or OpenID Connect sign-on and FIDO2 hardware keys
- You need approval-gated access to critical credentials, time-limited sharing and audit logs exported to your SIEM over syslog per RFC 5424
- You want a web client you can build and host yourself, with export in XML, CSV, TXT, HTML and encrypted PSWE formats to reduce lock-in

**Avoid if:**
- You require verified assurance before signing — ask the vendor: the public pages we read do not show it
- Your rollout depends on a documented administrator recovery path or emergency access with a waiting period; we found no public information on either
- Your auditors need compliance reporting aligned to ISO 27001 or NIS2 with a stated log-retention period; the published reports cover users, databases, groups and members

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 2/5 | 2/5 | 3/5 | 2/5 | 2/5 | 3/5 |
| Sharing, roles & recovery | 4/5 | 3.5/5 | 4/5 | 3/5 | 3.5/5 | 3.5/5 |
| SSO, directory sync & provisioning | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Audit logs, policies & reporting | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Hosting choice, offline access & export | 3.5/5 | 4/5 | 3.5/5 | 4/5 | 4/5 | 4/5 |
| European sovereignty | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **3/5** | **3.5/5** | **3.5/5** | **3/5** | **3.5/5** | **3.5/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Cloudflare dpf: Cloudflare · yes [S3]
- Encrypted payments: yes · Visa/Mastercard · Lastschriftverfahren [S3]
- Encryption: AES-256 (FIPS 197) · TLS 1.3 with Perfect Forward Secrecy · Argon2id [S6]
- GDPR: yes [S2]
- GDPR conform: yes [S1]
- ISO 27001: ISO/IEC 27001:2022 · TÜV NORD [S1]
- ISO 27001: TÜV NORD · ISO 27001 [S2]
- Pen test syss: 12/2025 · no critical or high-severity vulnerabilities · SySS GmbH · 10 · Trust Center [S6]
- Pentest syss: SySS GmbH · 10 [S1]
- Privacy link: https://www.password-depot.de/de/unternehmen/datenschutz.htm [S5]
- Salesforce dpf: Salesforce · yes [S3]
- Ssl tls: yes [S3]
- Syss certified: yes · SySS [S2]

**Data**
- Consent revocable: yes [S3]
- Export pswe encrypted: PSWE · yes · yes [S15]
- Portability: yes [S3]
- Retention default: Löschung, wenn Zweck entfällt oder Einwilligung widerrufen wird, vorbehaltlich gesetzlicher Aufbewahrungsfristen [S3]
- Server logs: Browsertyp und Browserversion · verwendetes Betriebssystem · Referrer URL · Hostname des zugreifenden Rechners · Uhrzeit der Serveranfrage · IP-Adresse [S3]

**Hosting**
- DPA website: Auftragsverarbeitungsvertrag (AVV) · DomainFactory [S3]
- Made in germany: Germany [S2]
- Storage options: yes · yes · no · yes [S6]
- Vendor cloud not required: no [S1]
- Website provider: Website-Hosting · München, Deutschland · DomainFactory GmbH [S3]

**Integrations**
- Export CSV fields: 13 · ; · yes · yes · yes · yes [S15]
- Export formats: XML · CSV · TXT · HTML · PSWE [S15]
- Export scope options: all entries in the database · entries in the active view · selected folder (with optional sub-folders) [S15]
- Rest API v2: 2.0 [S1]
- Web client source: https://github.com/acebit-gmbh/web_client_2 [S14]

**Legal**
- Commercial register: HRB 33038 · Amtsgericht Darmstadt [S4]
- Company: AceBIT GmbH · Schleiermacherstr. 10, 64283 Darmstadt, Deutschland [S14]
- Company name: AceBIT GmbH · Schleiermacherstr. 10, 64283 Darmstadt, Deutschland [S7]
- Contract language: Vertragssprache ausschließlich Deutsch [S5]
- Copyright holder: 1998-2026 · AceBIT GmbH [S4]
- Dispute resolution: no [S4]
- Duns number: 315356357 [S4]
- Entity: AceBIT GmbH · Schleiermacherstr. 10, 64283 Darmstadt, Deutschland [S1]
- Entity: DE198971166 · Schleiermacherstr. 10, 64283 Darmstadt · HRB 33038, Amtsgericht Darmstadt · AceBIT GmbH [S5]
- Entity: 64283 · Darmstadt · AceBIT GmbH · Schleiermacherstr. 10 · Deutschland [S6]
- Entity: AceBIT GmbH · Schleiermacherstr. 10, 64283 Darmstadt, Deutschland [S10]
- Entity name: AceBIT GmbH [S4]
- Eula link: https://www.password-depot.de/de/unternehmen/eula.htm [S5]
- Governing law: Bundesrepublik Deutschland [S5]
- Minimum age: yes [S5]
- Postal address: Darmstadt · Schleiermacherstr. 10 · Deutschland · 64283 [S4]
- Professional liability insurer: Zurich Insurance plc NfD · Deutschland [S4]
- Right of withdrawal: Verbraucher · 14 [S5]
- VAT id: DE198971166 [S4]

**Pricing**
- Enterprise features: 5 [S1]
- Maintenance options: 1 · 30 · 2 · 28.75 · 3 · 27.5 · yes [S2]
- Maintenance structure: 1 · 2 · 3 · 30 · 27.5 · 25 [S2]
- Perpetual license: yes · yes · yes [S1]
- Server license fees: 461.26 · EUR [S2]
- Server maintenance fees: 380.54 · EUR [S2]
- Server total net: 841.8 · EUR [S2]
- Trial: 30 · yes [S1]
- VAT treatment: 0 · yes [S2]
- VAT treatment: yes · yes [S5]

**Product**
- 2FA methods: TOTP · FIDO2/WebAuthn · Windows Hello [S6]
- Ad deleted object actions: ignore · disable · delete [S11]
- Ad deleted objects: yes [S11]
- Ad import modes: explorer · search [S11]
- Ad individual sync: yes [S11]
- Ad ldap path connection field: 10 [S11]
- Ad recursive scan: yes [S11]
- Ad signin options: current_user · specified_account [S11]
- Ad ssl option: yes [S11]
- Ad to entra user switch: Per-user authentication type switching (AD to Entra) since version 18.0.4 [S10]
- Approval workflows: yes · yes [S1]
- Audit trail: yes · yes [S1]
- Clients included: Windows · macOS · Linux · iOS · Android · Web-Interface [S2]
- Contracting via docusign: DocuSign · email [S2]
- Database access permission: Access to database permission controls whether a user or group can work with a database's content [S9]
- Default database permissions tab: default permissions for new databases [S13]
- Delivery download only: Download [S5]
- Deployment options: on-premises datacenter · Azure tenant · local clients/removable media · hybrid [S1]
- Development since: Darmstadt · 1998 [S1]
- Disabled policy default: Disabled permissions in server policies are valid for all users, groups (including super administrator) and all server databases [S9]
- Editions: Business · Personal · Windows · macOS · Linux · iOS · Android [S1]
- Effective rights view: Effective rights of users/groups can be viewed in a separate window [S8]
- Encryption: TLS 1.3 · AES-256 [S1]
- Encryption modes: AES-CBC available · AES-GCM (via Windows CNG) [S6]
- Enterprise server: yes · tamper-evident · yes · yes [S6]
- Entra autosync setting: Automatic synchronization configurable under Server settings → Entra ID → Synchronization [S10]
- Entra id version naming: Entra ID connection in Server Manager [S10]
- Entra login microsoft credentials: Imported Entra ID users log on with their Microsoft credentials [S10]
- Entra redirect issue fixed 1910: Microsoft redirect URL validation issue fixed as of version 19.1.0 [S10]
- Entries tab: Entries [S13]
- Entry level permissions: databases · folders · individual entries [S1]
- Entry permission interdependence: Read/Modify/Add/Delete entry permissions are dependent on each other [S9]
- Export authentication required: master password authentication required before export wizard starts · yes [S15]
- Export disable example: Export of entries permission can be disabled globally in server policies [S9]
- Group database permissions tab: Group Database permissions [S13]
- Group permissions: User permissions can be applied to groups [S9]
- High availability: yes · yes [S1]
- Identity integration: FIDO2/WebAuthn · TOTP · yes · SCIM · Active Directory · Microsoft Entra ID [S1]
- Kdf default values: 65536 · 3 · 4 · 600000 [S7]
- Ldap protocols: LDAP:// · LDAP:// · GC:// [S11]
- Ldap provider: LDAP · WinNT [S11]
- Leak checks: Tools → Security check → Check in Pwned passwords · k-anonymity check against Have I Been Pwned · yes [S6]
- Legacy encryption support: yes · no [S7]
- License keys email: E-Mail [S5]
- Licenses sold: over 100,000 licenses sold in over 25 years [S1]
- Maintenance email support: info@password-depot.de · Mo-Fr 9-17 Uhr, ausgenommen gesetzliche Feiertage · E-Mail [S5]
- Maintenance late payment termination: 14 [S5]
- Managed secret types: passwords · TOTP codes · SSH keys · certificates · API tokens · secure files [S1]
- Master password handling: yes · no [S6]
- Multiple databases: yes [S9]
- Named user licenses: named user, unlimited devices [S2]
- Nested ad groups: yes [S11]
- Oidc management API tab: OIDC Entra ID configuration includes Management API tab with API Base URL and Client Secret [S10]
- Oidc recommended: Support recommends OIDC with own app registration for Entra connection [S10]
- On premises or azure: on-premises · azure-tenant [S1]
- Ordering enterprise docusign: Angebot anfordern, Unterzeichnung via DocuSign [S5]
- Ownership reservation: yes [S5]
- Password policy tab: minimum password requirements: length, character types, dictionary attack checks [S13]
- Password sharing: yes · yes [S1]
- Permission color coding: Red permissions are denied, green permissions are enabled [S9]
- Permission levels database: database level · Access to database · Read entries · Modify entries · Add entries · Delete entries · Use Auto-Complete · Auto-fill web forms using browser add-ons · Accept new entries from browser add-ons · Print entries · Export entries ·… [S8]
- Permission levels entries folders: individual entries and folders · Access to entries · Read entries · Modify entries · Add entries · Delete entries · Share entries · Seal entries · Set second password [S8]
- Permission removal: Removed users/groups lose database access but remain on the server [S8]
- Permission states: Enabled · Undefined · Disabled [S9]
- Permissions levels: database level · single folders and entries [S9]
- Permissions management: Permissions tab allows detailed management and assignment of access rights to users and groups per database [S8]
- Permissions tabs: General · Entries and folders [S9]
- Private database permissions tab: Private Database Permissions [S13]
- Private databases: yes [S9]
- Recommended settings: AES/GCM + Argon2id · AES/CBC + PBKDF2 [S7]
- Reports types: Users report · Databases report · Groups report · Members report [S12]
- Rest API: REST-API for DevOps, automation and AI workflows; API version 2.0 stated later [S1]
- Seal admin delegation: Server administrators can add additional authorized persons allowed to change seal states [S8]
- Seal states: Sealed · Unsealed · Waiting for approval · Approval granted · Broken [S8]
- Sealed entries: Entries can be sealed; access requires approval or seal removal by an authorized person in the Server Manager [S8]
- Security support until: 19 · 2030-12 [S2]
- Security tab: settings for second password and offline databases [S13]
- Security updates duration: 10 [S5]
- Security updates free: yes · Download während des Supportzeitraums [S5]
- Server policies: Global server policies apply to all users/groups on the server [S9]
- Server policies access: Manage menu [S13]
- Server policies purpose: global settings affecting granting of rights to clients [S13]
- Server quote process: configure license then individual quote by email, non-binding · 1 [S2]
- Server rights management: Administrators can perform detailed rights management in the Server Manager so users only see objects they are allowed to access [S9]

**Support**
- Controller email: info@password-depot.de [S3]
- Documentation: video tutorials, best practices, technical documentation [S1]
- Enterprise server SLA: Telefonsupport · Fernwartung über TeamViewer · Enterprise Server Softwarepflege · 24 [S5]
- Personal german: German · Darmstadt · yes [S1]
- Standard reaction time: 72 [S5]
- Webinars: yes [S1]

19 more facts on the canonical page: https://whats-best.ai/software/password-management/password-depot

## Questions

### Is Password Depot European?

Yes. whats-best.ai classifies Password Depot as EU-Made.

### Where does Password Depot store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Password Depot have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Password Depot?

As of 21 Oct 2026, the panel rates [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper), [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) and [1Password (3/5)](https://whats-best.ai/software/password-management/1password) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Passbolt](https://whats-best.ai/software/password-management/passbolt) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Password Depot alternatives](https://whats-best.ai/software/password-management/password-depot/alternatives).

## What this page leaves out

- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 12 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.password-depot.de/de/ (checked 2026-10-13)
- [S2] Pricing page: https://www.password-depot.de/de/preise/bestellen-server.htm (checked 2026-10-13)
- [S3] Privacy policy: https://www.password-depot.de/de/unternehmen/datenschutz.htm (checked 2026-10-13)
- [S4] Legal notice: https://www.password-depot.de/de/unternehmen/impressum.htm (checked 2026-10-13)
- [S5] Terms of service: https://www.password-depot.de/de/unternehmen/agb.htm (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://www.password-depot.de/en/know-how/security-standard.htm (checked 2026-10-13)
- [S7] Encryption model & independent audits — found from sitemap: https://www.password-depot.de/en/support/faq/new-encryption-options-in-version-19-argon2id-aes-gcm-what-do-i-need-to-consider-with-mobile-apps-and-older-versions.htm (checked 2026-10-13)
- [S8] Sharing, roles & recovery — found from sitemap: https://www.password-depot.de/en/documentation/onlinehelp-enterprise-server/database-permissions-en.htm (checked 2026-10-13)
- [S9] Sharing, roles & recovery — found from sitemap: https://www.password-depot.de/en/documentation/onlinehelp-enterprise-server/permissions-for-users-en.htm (checked 2026-10-13)
- [S10] SSO, directory sync & provisioning — found from sitemap: https://www.password-depot.de/en/support/faq/connecting-entra-id-formerly-azure-ad-to-the-enterprise-server-requirements-and-recommended-approach.htm (checked 2026-10-13)
- [S11] SSO, directory sync & provisioning — found from sitemap: https://www.password-depot.de/en/documentation/onlinehelp-enterprise-server/active-directory-synch-en.htm (checked 2026-10-13)
- [S12] Audit logs, policies & reporting — found from sitemap: https://www.password-depot.de/en/documentation/onlinehelp-enterprise-server/reports-en.htm (checked 2026-10-13)
- [S13] Audit logs, policies & reporting — found from sitemap: https://www.password-depot.de/en/documentation/onlinehelp-enterprise-server/server-policies-en.htm (checked 2026-10-13)
- [S14] Hosting choice, offline access & export — found from sitemap: https://www.password-depot.de/en/support/faq/installing-and-deploying-the-web-client-2-0-on-premises.htm (checked 2026-10-13)
- [S15] Hosting choice, offline access & export — found from sitemap: https://www.password-depot.de/en/documentation/onlinehelp-client/export-entries-en.htm (checked 2026-10-13)

---

Cite as: whats-best.ai, "Password Depot — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/password-depot

Corrections: https://whats-best.ai/correct/664?target=page