Passwords

Personal and organisation passwords, sharing, TOTP codes, and passwords for clients and projects.

The built-in password vault has two kinds of password:

• Personal passwords belong to you. Nobody else can see them unless you share them, and no permission, not even the Owner role, gives anyone access to another person's personal passwords.
• Organisation passwords belong to the workspace. A client is just a field on an organisation password, so is a project. They show up on the Passwords page and on the Passwords tab of the client they are linked to.

Either kind can include a TOTP secret, so the app generates the 6-digit 2FA code for you.

Where it lives

Workspace, Passwords has two tabs: Personal and Organisation. A client's page (CRM, Clients, [client]) has a Passwords tab that shows the organisation passwords linked to that client. The tab is there for anyone whose workspace has the Passwords feature; it lists only the passwords your role or a share lets you see, and says so when there are none for you.

Both places work the same way. The one difference: on the client's tab the client never changes. A new password goes to that client, and an existing one keeps the client it has (it shows read-only in the edit form, as "No client" for a password with none). To change a password's client, edit it on the Organisation tab.

Adding a personal password

1. Open the Personal tab.
2. Click Add Password.
3. Fill in:
   • Label (required). Example: Stripe dashboard.
   • Website (optional).
   • Username / Email (required).
   • Password (optional). Click the dice icon to generate a random 16-character value.
   • Linked Passwords (optional). Chain related entries, for example GitHub linked to SSH key.
   • TOTP Secret (optional). The setup key from the service's 2FA page, not the 6-digit code itself.
   • Notes (optional). Recovery codes, security questions, anything else.
4. Click Save Password.

Adding an organisation password

You can add one from the Organisation tab, or from a client's Passwords tab, if your role has one of the Manage password permissions listed below.

The form has the same fields as a personal password, plus:

• Client (optional). Link the password to a client. On the client's own tab it is read-only.
• Project (optional). Link it to one project. Choosing a project fills in the project's client automatically, and the client always matches the project.
• Show in this client's portal. Only available while a client is chosen. When it is on, the client sees the password on their portal Passwords tab (once that tab is turned on for the client). It is off by default.

You can only choose clients and projects you are allowed to manage passwords for. A password with no client and no project needs the Manage all organisation passwords permission. Client and project fields need the CRM feature.

If a project is moved to a different client, its passwords move with it, and their portal switch is turned off so nothing is shown to the wrong client.

Moving a personal password to the organisation

1. Open one of your personal passwords.
2. Click Move to organisation.
3. Choose the client and project it belongs to, and whether it shows in the client's portal.
4. Click Move.

Once moved, the password belongs to the organisation: people whose role lets them see organisation passwords for that client or project can see it, the people it was already shared with keep their access, and it leaves your personal list. If you choose neither a client nor a project, it is visible to everyone whose role lets them see all organisation passwords (by default Owners, Admins and Managers). Any links it had to your other personal passwords are removed. You need a Manage permission that covers the client or project you choose. Only the owner can move a personal password, and a password shared with you is not yours to move.

Revealing a password

The password field is masked by default. Click the eye icon to show it inline. Click the copy icon to copy it without showing it.

Generating a TOTP code

If a TOTP secret is stored, the entry has a Verification Code that stays hidden until you click the eye icon. Once shown it is a 6-digit code with a 30-second countdown ring beside it, split into two groups (123 456) for readability. The ring turns red when 5 seconds or fewer are left. Use the copy icon to copy the code.

The 6-digit code is generated for everyone who can see the entry's codes. The TOTP secret itself (the setup key) is shown only to people who can manage the password, in its edit form. Someone who can only view it, or has it shared with them, can use the code but cannot read the secret.

Sharing a password

You can share your own personal passwords, and any organisation password you are allowed to manage.

1. Open the password.
2. Click Share.
3. Under Add people, search by name and pick one or more people. The list shows names and pictures only, no email addresses. You cannot share with yourself, and only current members of the workspace can be added.
4. Pick the access duration: No expiry (permanent), 1 hour, 6 hours, 1 day, 7 days, 30 days, or a custom date.
5. Click Share with N users.

A new share does not include the 2FA code. To let a person see it, turn it on for them afterwards (see below).

A person you share an organisation password with can see it even without any password permission. They can read and copy it, but cannot edit, delete or re-share it. Organisation passwords show who shared them ("Shared with you by ..."). The client and project a password is linked to are shown to that person only if they are allowed to open that client or project; otherwise the password appears without them.

Sharing is how you give a project's team access. Being a member of a project does not show its organisation passwords. Share each password with the people who need it, or give them one of the View permissions below.

Adjusting or revoking a share

Open the password and click Share again. The People with access list in the dialog shows everyone who has access, with their expiry. For each person you can:

• Click the expiry ("Permanent" or "Expires ...") to change it, then Save.
• Click MFA to share the 2FA code with that person, and click it again to stop sharing it. The button appears only when the password has a TOTP secret.
• Click Revoke to remove access immediately.

Permissions

Organisation passwords are controlled by eight permissions in the Passwords group. A Manage permission includes viewing. None of them ever shows anyone else's personal passwords.

By default Owners, Admins and Managers have all eight, and Members and Developers have none. Anyone can use their own personal vault. Having a password shared with you also gives you access to that one password, with or without any of these permissions, which is the way to give a Member access to the passwords they need.

The whole feature is gated by the Passwords feature at the workspace level. If you do not see Passwords in the sidebar, it is not enabled for your plan.

Passwords for clients and the client portal

To show a password to a client through their portal:

1. Open the client (CRM, Clients, [client]).
2. Open the Passwords tab.
3. Click Add Password, fill in the entry, turn on Show in this client's portal, and save.
4. Make sure Portal Settings, Passwords is turned on for that client.

The client sees only the passwords you marked to show in the portal, with the same reveal, copy and TOTP controls.

When someone leaves the workspace

• Their access to every password shared with them ends immediately.
• A personal password they owned that a colleague has permanent access to (a share with no expiry) passes to that colleague, who becomes its owner. If that colleague could not see the 2FA code, the stored TOTP secret is removed, and nobody the password is shared with sees 2FA codes for it until the new owner turns that on for them again.
• Their other personal passwords in the workspace are deleted, including ones they had shared only for a limited time.
• Organisation passwords stay. They belong to the workspace, not to the person who added them.
• If they are added back later, none of the personal passwords come back.