# Passwork — Password Management

Passwork by Passwork Europe S.L. holds a panel rating of 2/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Passwork Europe S.L. (https://passwork.pro/de/)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/password-management/passwork
- Alternatives: https://whats-best.ai/software/password-management/passwork/alternatives ([markdown](https://whats-best.ai/software/password-management/passwork/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Passwork Europe S.L.
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Passwork, a password manager named in the imprint as Passwork Europe S.L. of Barcelona, earns its best marks in sharing and access control: custom roles beside Owner, Administrator and Member, per-recipient read or read-and-edit sends, tracked and revocable access, single-use links that expire three minutes after opening, and emergency recovery via a corporate administrator attached to every vault plus a blocked service account whose master password sits offline. Its published cryptography is candid — AES-256-CBC client-side, AES-256-CFB server-side, RSA-OAEP key wrapping, a per-field table, a threat model — while zero-knowledge covers passwords and secrets, not the searchable name, login and URL fields. Weakest are pricing transparency, with the captured pricing page yielding no per-user rate, tier, seat minimum or term, and sovereignty, where the transparency statement records rights previously held by Passwork FZ-LLC (UAE) until the 2024 acquisition and the captured pages confirm neither hosting location nor subprocessors. Every other criterion sits at 4, except deployment and portability at 4-5; sovereignty is the only criterion spanning more than a point.

**Speaks for it:**
- Sharing and access control scored 5-6: custom roles beside Owner, Administrator and Member, per-recipient read or read-and-edit on sent passwords, tracked revocable access, and single-use links expiring three minutes after opening.
- Emergency recovery is documented — a corporate administrator automatically added to every vault of a type, plus a blocked service account with its master password held in a physically secure offline location.
- The published encryption scope names AES-256-CBC client-side, AES-256-CFB server-side and RSA-OAEP vault-key wrapping, with a threat model covering database leak, server compromise and traffic interception.
- SAML single sign-on is documented in depth for Microsoft Entra ID, AD FS and Keycloak, down to attribute mapping, endpoints and Kerberos/SPNEGO seamless login.
- Self-hosting is a documented edition, with a CLI that injects secrets at runtime and a JSON export that preserves vault and folder structure.

**Held against it:**
- Pricing transparency scored 0-1: the captured pricing page yields no per-user rate, tier contents, seat minimum, term or self-hosted licence price.
- Sovereignty scored 1-3: the captured pages confirm neither where vault data and metadata are hosted nor any subprocessor, and the transparency statement records rights previously held by Passwork FZ-LLC (UAE) until the 2024 acquisition.
- We found no public information on an independent audit with a named auditor and date, on a bug bounty, or on disclosed incident history.
- We found no public information on SCIM or directory sync for joiners and leavers, on how the vault key is released under single sign-on, or on FIDO2 hardware keys and passkeys; the only second factor evidenced is the vendor's own authenticator app.
- We found no public information on enforceable master-password or MFA policies, password-health or breach reports, or audit-log retention; the only retention figure captured is 90 days for IP addresses.

**Best for:**
- You need a self-hosted password manager — the on-premises edition states that passwords never leave your infrastructure — with activity logs routed via syslog or stdout into your own monitoring stack.
- Your team's daily work is governed credential sharing: per-recipient edit rights, expiring external links and a documented emergency-recovery path.
- You want encryption internals published — algorithms, per-field scope, a threat model — as a condition of trust, even absent third-party verification.
- You use Microsoft Entra ID, AD FS or Keycloak and want single sign-on documented down to endpoints, attribute mapping and Kerberos seamless login.

**Avoid if:**
- You must price the purchase before talking to sales — the captured pricing page yields no per-user rate, tier, seat minimum, term or self-hosted licence price.
- You must document where hosted vault data and metadata reside and which subprocessors can touch them — unconfirmed on the captured pages, with the transparency statement recording rights previously held by a UAE entity until the 2024 acquisition.
- Your procurement requires third-party verification — we found no public information on an audit with a named auditor and date, a bug bounty or disclosed incident history.
- Your joiner-leaver process depends on directory sync — we found no public information on SCIM or automated deprovisioning, and how the vault key is released under single sign-on is undocumented.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Sharing, roles & recovery | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| SSO, directory sync & provisioning | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Audit logs, policies & reporting | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Hosting choice, offline access & export | 2/5 | 2.5/5 | 2/5 | 2/5 | 2.5/5 | 2/5 |
| European sovereignty | 1/5 | 1/5 | 1.5/5 | 1/5 | 0.5/5 | 0.5/5 |
| Pricing transparency | 0/5 | 0/5 | 0.5/5 | 0/5 | 0.5/5 | 0.5/5 |
| **Weighted verdict** | **2/5** | **2/5** | **2/5** | **2/5** | **2/5** | **1.5/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Ddos: Cloudflare [S3]
- Development security: yes [S1]
- Encryption: 1.3 [S3]
- External audits: yes [S1]
- GDPR nis2: yes · yes [S1]
- Hackerone: HackerOne [S1]
- ISO 27001: yes [S1]
- ISO 27001: yes [S3]
- ISO 27001: yes [S6]
- ISO 27001: yes [S10]
- ISO 27001: ISO 27001 · yes [S14]
- ISO 27001: Site footer references an ISO 27001 certificate [S12]
- MFA: yes [S3]
- Owasp training: yes [S1]
- Pentest: HackerOne [S3]
- Sod ISO: ISO 27001 · SOC 2 [S9]

**Data**
- Account retention: duration of account + 30 days after deletion [S3]
- Breach notification: yes [S3]
- Deletion on request: yes [S3]
- Demo retention: 3 [S3]
- Log retention: 90 [S3]
- No sale: no [S3]
- Payment retention: tax law · 7 [S3]
- Portability tools: yes [S3]
- Rights: access · rectification · erasure · restriction · portability · objection · automated_decisions [S3]
- Rights response days: 30 [S3]

**Integrations**
- Browsers: Chrome · Firefox · Edge · Safari [S3]
- Browsers: Chrome · Firefox · Edge · Safari [S6]
- Mobile apps: iOS (App Store) · Android (Google Play) [S6]

**Legal**
- Address: Barcelona · Carrer d'Arago, 208, 2-5 · Spanien · 08011 [S4]
- Applicable law: Spain [S3]
- Change notice days: 30 [S3]
- Company: Passwork Europe SL · Barcelona, Spain [S6]
- Content responsible: Passwork Europe SL. [S4]
- Controller: Passwork Europe SL · Barcelona, Spain [S3]
- DPA: by contacting info@passwork.pro · yes [S3]
- DPA scc: Standard Contractual Clauses [S3]
- Effective date: 2025-12-01 [S3]
- Entity: Passwork Europe SL · Barcelona, Spain [S8]
- Entity: Passwork Europe SL · 2017-2026 · Barcelona, Spain [S10]
- Entity: Passwork Europe SL · Spain · Barcelona [S12]
- Entity: Passwork Europe SL · Barcelona, Spain [S14]
- Entity name: Passwork Europe SL. [S4]
- Operating entity: Passwork Europe SL · Barcelona, Spain [S11]
- Policy version: 2025-12-01 · 2.1 [S3]
- VAT id: ESB19399534 [S4]

**Pricing**
- Advanced: Advanced · annual · 4.5 [S1]
- Discount multiyear: yes [S1]
- Lifetime: Lifetime · one-time payment [S1]
- Lifetime discount: up to 50% savings vs long-term subscription [S1]
- Payment processors: Paddle · PayPal · no [S3]
- Savings claim: 30 [S1]
- Standard: Standard · annual · 3 [S1]

**Product**
- 2FA app: yes [S1]
- Action history: Action History access can be revoked from Member role [S9]
- Activity log: yes [S9]
- Activity log feature: Passwork has an Activity log feature documented under Administration [S12]
- Activity log output parameters: syslog · stdout · ACTIVITY_LOG_OUTPUT [S12]
- Administrator role: Admins manage users, configure settings, and access vaults where they are corporate administrators [S9]
- API: yes [S1]
- API access: yes · programmatic access to vault data [S9]
- API access disable: yes [S9]
- Apps: yes [S1]
- Browser extensions: Chrome · Firefox · Edge · Safari · yes [S1]
- Builtin roles: Owner · Administrator · Member (User) · yes [S9]
- Cli: yes [S1]
- Client algorithm: browser · AES-256-CBC · CSE enabled [S6]
- Corporate administrator: no · yes [S9]
- Course breach detection stat: IBM 2024 Cost of a Data Breach Report · 194 [S13]
- Course chapter topic: Security logging and monitoring [S13]
- Course free logging stacks: ELK Stack · Grafana Loki · Graylog [S13]
- Course free siem alternatives: Full SIEM · Wazuh [S13]
- Course open source cost: 2 · 0 [S13]
- Course recommended small team stack: small teams · Grafana Loki [S13]
- Course retention HIPAA: HIPAA · 6 years [S13]
- Course retention internal best practice: Internal best practice · 90 days · 1 year [S13]
- Course retention pci dss: 3 months immediately available · PCI-DSS · 1 year [S13]
- Course siem cost estimate: 100000 · 50000 [S13]
- Cse master password: yes [S9]
- Cse reason search: server-side indexing for search [S6]
- Cse server visibility: passwords, secrets, files · yes [S6]
- Data processed: data_processor_for_user_data [S3]
- Desktop app: yes [S1]
- Encryption model: Two-level protection model: client-side encryption and server-side encryption [S6]
- Export formats: CSV · JSON · yes · yes [S14]
- Export location: Export is triggered via Account settings [S14]
- Export scope selection: Export allows selecting specific vaults or folders and choosing output format [S14]
- External link encryption: link key · yes [S6]
- External link recipients: yes [S8]
- Feature search: yes · yes [S6]
- Link types: reusable · single-use · one hour · one week · one month · unlimited · 3 [S8]
- Metadata protection: server-side AES-256-CFB · TLS/HTTPS · application-level access control [S6]
- Mobile apps: App Store · Google Play [S3]
- On premise: yes [S1]
- On premises: yes [S3]
- Owner role: 1 · no · yes [S9]
- Password dual encrypted: yes · yes [S6]
- Php fpm catch workers output: PHP-FPM catch_workers_output redirects worker stdout/stderr; default is no [S12]
- Php fpm logging config: PHP-FPM error_log supports file, syslog and stream destinations [S12]
- Private rsa key protection: master key · yes [S6]
- Recognition omdia: Omdia On the Radar [S1]
- Record key protection: Vault key (AES-256-CBC) · Server key [S6]
- Role based user management: yes [S9]
- Scalability: 10 to over 30,000 [S1]
- Secret management: yes [S3]
- Secrets manager included: yes [S1]
- Self hosted edition: yes [S3]
- Send access levels: access levels settable per recipient; read-and-edit edits apply to original [S8]
- Send to users: yes [S8]
- Server algorithm: server · AES-256-CFB · always [S6]
- Service account blocked: yes [S9]
- Service account emergency access: emergency vault recovery [S9]
- Service description: password vaults · collaboration · user rights management · change tracking · security monitoring · one-click login [S3]
- Share bulk delete: yes [S8]
- Share tracking: yes [S8]
- Shortcut drag drop: yes [S8]
- Shortcut sharing: yes [S8]
- Siem syslog: syslog [S1]
- SSO advanced login flows: Kerberos/SPNEGO for SAML · Seamless login through WIA and SAML [S11]
- SSO attribute mapping: emailAddress · displayName [S10]
- SSO authn context setting: Identification errors with IDP can be resolved by setting requestedAuthnContext to false in JSON settings [S10]
- SSO endpoints: /api/v1/sso/acs · /api/v1/sso/sls · /api/v1/sso/metadata [S10]
- SSO idp login: Login performed through identity provider (IdP) verifying user identification data [S11]
- SSO SAML: Passwork supports SAML SSO configuration with Microsoft Entra ID (Azure AD) [S10]
- SSO supported providers: AD FS · Keycloak · Microsoft Entra ID (Azure AD) [S11]
- SSO toggles: yes · yes [S11]
- Threat model: server-side encryption · client-side encryption · TLS [S6]
- Totp dual encrypted: yes · yes [S6]
- User access tab: yes [S9]
- Vault key protection: User RSA key (RSA-OAEP) · Server key [S6]
- Zero knowledge: passwords and secrets [S6]

## Questions

### Is Passwork European?

Yes. whats-best.ai classifies Passwork as EU-Made.

### Where does Passwork store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Passwork have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Passwork?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Passwork alternatives](https://whats-best.ai/software/password-management/passwork/alternatives).

## What this page leaves out

- 69 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 18 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 17 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 12 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://passwork.pro/de/ (checked 2026-10-13)
- [S2] Pricing page: https://passwork.pro/cloud-teams/ (checked 2026-10-13)
- [S3] Privacy policy: https://passwork.pro/tech-guides/privacy-policy/ (checked 2026-10-13)
- [S4] Legal notice: https://passwork.pro/de/impressum/ (checked 2026-10-13)
- [S5] Ownership statement: https://passwork.pro/transparency-statement/ (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://passwork.pro/tech-guides/cryptography/encryption-scope/ (checked 2026-10-13)
- [S7] Encryption model & independent audits — found from sitemap: https://passwork.pro/audits/ (checked 2026-10-13)
- [S8] Sharing, roles & recovery — found from sitemap: https://passwork.pro/user-guides/passwords/share-password/ (checked 2026-10-13)
- [S9] Sharing, roles & recovery — found from sitemap: https://passwork.pro/onboarding/security-review/roles-and-permissions/ (checked 2026-10-13)
- [S10] SSO, directory sync & provisioning — found from sitemap: https://passwork.pro/tech-guides/administration/sso-settings/sso-configuration-with-microsoft-entra-id-azure-ad/ (checked 2026-10-13)
- [S11] SSO, directory sync & provisioning — found from sitemap: https://passwork.pro/tech-guides/administration/sso-settings/intro/ (checked 2026-10-13)
- [S12] Audit logs, policies & reporting — found from sitemap: https://passwork.pro/tech-guides/administration/action-history/php-fpm-logging/ (checked 2026-10-13)
- [S13] Audit logs, policies & reporting — found from sitemap: https://passwork.pro/security-champion-course/devsecops/security-logging-monitoring/ (checked 2026-10-13)
- [S14] Hosting choice, offline access & export — found from sitemap: https://passwork.pro/user-guides/settings/import-and-export/export-data/ (checked 2026-10-13)
- [S15] Hosting choice, offline access & export — found from sitemap: https://passwork.pro/on-premise-password-manager/ (checked 2026-10-13)

---

Cite as: whats-best.ai, "Passwork — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/passwork

Corrections: https://whats-best.ai/correct/666?target=page