# Psono — Password Management

Psono by esaqa GmbH holds a panel rating of 2/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: EU-Made; sovereignty: not determined.

- Vendor: esaqa GmbH (https://psono.com)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/password-management/psono
- Alternatives: https://whats-best.ai/software/password-management/psono/alternatives ([markdown](https://whats-best.ai/software/password-management/psono/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: esaqa GmbH
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Psono, an open-source, self-hostable password manager from esaqa GmbH of Vorra, Germany, scores highest on deployment and portability, 5 to 7: self-hosting is free of charge with Docker images and Community and Enterprise installation guides, and clients span Windows, macOS, Linux, Android, iOS, three browser stores, a web client and a CLI. Security architecture follows at 4 to 6 — Curve25519 and Salsa20 through NaCl, scrypt derivation, three transport layers with perfect forward secrecy, on a publicly auditable codebase — but the audits described are the vendor's own internal reviews, and we found no public information on an independent audit, bug bounty or incident history. Weakest is sharing and access control at 2 to 4: password sharing is named as a feature while no public information appears on permission models, admin recovery or a leaver's shared items. Sovereignty scores 3 to 4: the hosted service runs on AWS and Google Cloud with Cloudflare and no region stated. Identity integration is a flat 4, SSO included up to 10 users, and the judges did not materially split on any criterion.

**Speaks for it:**
- Self-hosting is free of charge for on-premises use, with Docker images and dedicated Community and Enterprise installation guides
- Client coverage spans desktop, mobile, three browser extension stores, a web client and a CLI, with signed APT and RPM repositories and a direct Android APK
- The security page names concrete cryptography — Curve25519 and Salsa20 through NaCl, scrypt derivation, three transport layers with perfect forward secrecy — on a publicly auditable codebase
- All business features, including SSO over LDAP, SAML and OIDC, audit logging and the SSH, RDP and VNC gateway, are free up to 10 users
- Self-hosting takes the vendor out of the data path entirely, which judges identified as the strongest sovereignty lever here

**Held against it:**
- We found no public information on a permission model for shared secrets — view-only or time-limited sharing, admin account recovery, or what happens to a leaver's shared items
- The only audits described are the vendor's own internal code reviews, and we found no public information on an independent audit with a named firm, a bug bounty or incident history
- Audit logging, policies and compliance enforcement appear as feature names, with no public information on which events are recorded, log export, retention or SIEM integration
- The cloud service runs on AWS and Google Cloud with Cloudflare in front and no region stated, and we found no public information on a subprocessor list or a data-processing agreement covering metadata and logs
- The documented backup path is a simple text-file function, with no public information on whether attachments and all item types survive an export or on offline access during an outage

**Best for:**
- You want to run the password manager on your own infrastructure: on-premises hosting is free of charge with Docker images and Community and Enterprise installation guides, and the codebase is publicly auditable
- Your team is 10 users or fewer: all business features, including SSO over LDAP, SAML and OIDC, audit logging, policies and the SSH, RDP and VNC gateway, are free up to 10 users
- Your users and pipelines span platforms: desktop apps for Windows, macOS and Linux from signed repositories, mobile apps with a direct APK, extensions across Chrome, Firefox and Edge, a web client and a CLI for CI workflows

**Avoid if:**
- You need documented rights around shared secrets — view-only access, time limits, admin recovery, a leaver's items: sharing and access control scored 2 to 4 and we found no public information on a permission model
- You must show an ISO 27001 or NIS2 assessor documented audit coverage: audit and policy scored 3 to 4, with audit logging named as a feature but no public information on which events are recorded or whether logs export to a SIEM
- You need a documented full-fidelity exit: the documented backup is a simple text-file function, and we found no public information on whether attachments and all item types survive an export or on offline access during an outage
- You need to compute an annual invoice above 10 users: Psono SaaS and Psono Enterprise Edition are governed by separate agreements, and we found no public prices for either

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 2/5 | 3/5 | 2.5/5 | 2.5/5 | 2.5/5 | 3/5 |
| Sharing, roles & recovery | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1/5 | 2/5 |
| SSO, directory sync & provisioning | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Audit logs, policies & reporting | 2/5 | 1.5/5 | 1.5/5 | 2/5 | 1.5/5 | 2/5 |
| Hosting choice, offline access & export | 3/5 | 2.5/5 | 3/5 | 3/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 1.5/5 | 1.5/5 | 1.5/5 | 2/5 | 2/5 | 2/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2/5** | **2/5** | **2/5** | **2/5** | **2.5/5** | **2.5/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Law: German data privacy law [S2]

**Data**
- Collection: IP address · browser/OS · language · request date/time · requested resource · transferred data · status code · referrer [S2]
- Daily backups: nightly · yes [S5]
- Order collection: name · address · payment information [S2]
- Rights: informed · access · rectification · erasure · restrict processing · data portability · object · automated decision making including profiling [S2]
- Third parties: no [S2]

**Hosting**
- Cloud providers: AWS · GCP [S5]
- Self host free: yes · yes [S5]

**Legal**
- Commercial register: Nuremberg Registry Court · HRB 37978 [S3]
- Controller: esaqa GmbH · Tiergartenstr. 13, 91247 Vorra, Germany [S2]
- Entity: esaqa GmbH · Tiergartenstr. 13, 91247 Vorra, Germany [S4]
- Entity: esaqa GmbH · Tiergartenstr. 13, 91247 Vorra, Germany [S5]
- Entity: esaqa GmbH · Tiergartenstr. 13, 91247 Vorra, Germany [S6]
- Entity name: Tiergartenstr. 13, 91247 Vorra, Germany · esaqa GmbH [S3]
- Export compliance: users must comply with German and international export laws [S4]
- Jurisdiction: Nuremberg, Germany [S4]
- Liability limitation: liability limited to willful misconduct and gross negligence; service provided as is without warranties [S4]
- Register: DE333156173 · Nuremberg Registry Court HRB 37978 [S2]
- Terms modification: yes [S4]
- Updated: 2024-05-20 [S2]
- VAT id: DE333156173 [S3]

**Pricing**
- Business edition features: all community features · LDAP & SAML & OIDC SSO · audit logging · policies · compliance enforcement · gateway (SSH/RDP/VNC) · extended support option [S1]
- Business extended support: yes [S1]

**Product**
- Account required: yes [S4]
- Android apk direct: Android APK direct download [S6]
- Aup reference: https://psono.com/acceptable-use-policy/ [S4]
- Automated testing: yes [S5]
- Browser encryption: NaCl authenticated encryption · browser · secret object [S5]
- Browser extension stores: Chrome · Firefox · Edge [S6]
- Chromium browsers extension: Chrome Web Store · Brave · Opera · Vivaldi · Chromium [S6]
- Cli binaries: linux x86_64 · linux armv7 · linux aarch64 [S6]
- Client side encryption: yes [S1]
- Clients: app · webclient · admin client [S1]
- Code audits: yes · yes [S5]
- Codebase auditable: yes [S1]
- Crypto core: NaCl · Curve25519 · Salsa20 · PyNaCl · ecma-nacl [S5]
- Ddos protection: Cloudflare · yes [S5]
- Desktop platforms: Windows · macOS · Linux [S6]
- Download platforms: browser extension, desktop app, mobile app, web client, command line utility [S6]
- Encryption at rest: private data such as email address in database · Salsa20 with Poly1305 [S5]
- Extension features: passkeys · autofill · secure vault access [S6]
- Free instance: free public demo instance of Psono software at psono.pw [S4]
- Free tier: 10 [S1]
- Free tier features: all community features · LDAP & SAML & OIDC SSO · audit logging · policies · compliance enforcement · gateway (SSH/RDP/VNC) [S1]
- Ip ownership: esaqa owns all IP rights in the Service and underlying software [S4]
- Linux appimage: AppImage · yes [S6]
- Linux repos: APT · RPM · 8CE66303F9A609E0652C8B6B8B5148E325315EFF [S6]
- Mac app store: Mac App Store · yes [S6]
- Mobile platforms: Android · iOS · yes [S6]
- Multi layer encryption: multi-layer encryption: client-side, transport, storage [S1]
- Multizone network: yes · yes [S5]
- Open source: yes [S5]
- Opensource: yes · yes [S1]
- Opensource edition features: open source · password generator · password sharing · multifactor authentication [S1]
- Password derivation: scrypt · datastore encryption [S5]
- Prohibited uses: High-Risk Activities and cryptocurrency mining prohibited [S4]
- Regular updates: yes [S5]
- Scope exclusions: Terms cover only psono.pw free service; Psono SaaS and Psono Enterprise Edition governed by separate agreements [S4]
- Self hosting: Community Edition · Enterprise Edition · yes [S6]
- Text file backup: yes [S5]
- Tls pfs: yes · HTTPS TLS 1.2 [S5]
- Transport encryption layer: tunnel · intermediate transport encryption layer between browser and application server [S5]
- Transport layers: 3 · client-side encryption [S5]
- Vulnerability scans: yes · yes · yes [S5]
- Web app hosted: psono.pw · yes [S6]

**Support**
- Discord: Discord [S1]
- Discord: yes [S3]
- Discord: yes [S4]
- Discord: Discord · yes [S6]

## Questions

### Is Psono European?

Yes. whats-best.ai classifies Psono as EU-Made.

### Where does Psono store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Psono have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Psono?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Psono alternatives](https://whats-best.ai/software/password-management/psono/alternatives).

## What this page leaves out

- 4 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://psono.com/ (checked 2026-10-13)
- [S2] Privacy policy: https://psono.com/privacy-policy (checked 2026-10-13)
- [S3] Legal notice: https://psono.com/legal-notice (checked 2026-10-13)
- [S4] Terms of service: https://psono.com/terms-and-conditions (checked 2026-10-13)
- [S5] Encryption model & independent audits — found from sitemap: https://psono.com/security (checked 2026-10-13)
- [S6] Hosting choice, offline access & export — found from sitemap: https://psono.com/download (checked 2026-10-13)

---

Cite as: whats-best.ai, "Psono — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/psono

Corrections: https://whats-best.ai/correct/662?target=page