Passwork.

Password manager
for your business
User’s manual

passwork.pro
1
Passwork is a reliable
password manager for
your company
Passwork increases the security and usability of
corporate passwords. Use protected storage vaults,
configure user rights, track actions & changes and
log in to sites with just one click

1
Features of the self-hosted
edition
Installed on your servers
All data is encrypted and only you have access to it

Convenient user and access rights

management
Invite employees to shared folders and vaults,
configure access rights and more

LDAP authorization support (integrated with

Active Directory)
Logins and passwords from Windows can be
used to log into Passwork

The source code is open for audit

This allows one to verify the absence of
vulnerabilities and unacceptable functionalities

A history of actions and changes

Track information about all actions
within your Passwork, all in one place

Data exporting
Export your data both in JSON and CSV formats

2
General principles
The self-hosted edition of Passwork stores passwords in encrypted
forms on your own server.

Passwork uses the paradigm of secure containers as “vaults”. The

vault stores passwords, as well as subfolders, each of which can
contain both passwords and other folders. Access to the vault can
only be attained via a 256-bit master password.

Users are required to input a master password to gain access to

the vault and subfolders. After entering the master password, our
browser plug-in shall conduct authorization on the website in
question. This is all done in one click. The user also has the ability
to copy the desired password to the clipboard.

The access customization system allows you to provide company

employees with access only to certain passwords through the use
of access levels. There’s an addtional option to set
user roles and access levels. For example, finance department
employees will not have access to passwords of the IT department.

The password can be sent as a link to any employee within your

company. Alternatively, you may share a certain password with a
specific employee directly.

3
Contents
Working with vaults
What is a vault? 7
Vault creation 8
Renaming the vault 9
Create a folder 10
Adding users to the vault 11
Viewing the vault’s access rights 13
Viewing action history 14
Importing data into the vault 15
Removing the vault 16

Working with folders

What is a folder? 17
Create a folder 17
Rename a folder 19
Copy folder 20
Moving a folder 21
Adding users to a folder 22
View folder permissions 23
Importing data into a folder 24
Deleting a folder 25

Working with passwords

Adding a password 26
Password edit 27
Search for a password 28
Clipboard29
Copy password 30
Move password 31
Providing password access 32
Viewing a history of actions 33

4
Viewing password editions 34
Adding a password to “starred”  35
Remove password 36
General principles 37
Viewing a list of users 38
User creation 40
Edit users 41
Setting up access rights 42
Applying roles 44
Invites46

Working with roles

What are roles? 47
Role creation 48
Editing a role  49
Deleting roles 52

Settings
Go to settings 53
Account settings 53
Authorization & Two-factor authentication 54
API Settings 54
LDAP Settings 55
SSO Settings  56
Company Info 56
Passwork Settings 57
Security dashboard 57
Activity log 58
Export data 58
Import data 59

5
LDAP Integration
Configuring an LDAP Integration 60
Server settings 62
Sign-in restrictions 64
Adding users 66

Working with the browser extension

Installing the extension  68
Extension authorization 69
Extension settings 70
List of vaults 72
Recent passwords 73
Starred passwords 74
Search for a password 75
Save password 76
Clipboard77
Authorization on sites 78
Password generator 80
Create a new password 82
Password edit 83

6
Working with vaults
What is a vault?
A vault is an encrypted password storage unit. When you create
a vault, a random 256-bit master password is automatically
generated. A special cryptographic algorithm ensures that
the master password cannot be guessed and subsequently
compromised.

There are two types of vaults in Passwork: organization vaults and

private vaults. Only the owner has access to the private vaults,
while access to the organization’s vaults is determined by the
access settings.

All organization and private vaults are displayed

on the left-hand side of the screen

7
Vault creation

To create a new private To create a new organization

vault, click te “Add vault” vault, click the “Add vault” button
button in “Private vaults” in the “Organization vaults”
section section

In the window that appears, enter a name for the

vault and click “Save”

8
Renaming the vault

Select the vault you Click the “Actions” link and select
want to rename via the “Rename” from the menu that
pane on the left appears

Enter a new name for the vault and click “Save”

9
Create a folder

Select the vault via the Click on the “Actions” link and
pane on the left select “Create folder”

Enter a name for the folder and click the “Save” button.

10
Adding users to the vault
To make the passwords stored in the vault available to other users
in the workspace, you’ll need to add these users to the vault.

In the required vault, click the “Add to the vault” button and
select “Invite”

In the drop-down list labelled Set up user access rights for this
“Login”, select the login of the vault. Click “Permission Settings”
user that you wish to invite to the to view and edit the current
vault access settings

Click “(+) Invite one more user” to Click the “Send invitation” button
send invitations to multiple users to add users

11
If you want to invite multiple users, you can generate a hyperlink. To do
this, click the “Add to the vault” button and select “Create hyperlink”.

Specify the required parameters of the hyperlink, click

“Generate link”, and then copy the resulting hyperlink

Click “Vault Links” to see the link history (it will appear after the
first link is generated). A list of all this vault’s links will be displayed.

12
Viewing the vault’s access rights

Select the vault via the Click on the “Actions” link and
pane on the left select “Permissions”

The “Users in vault” tab The “Roles” list The “Links” list
displays all users who have displays contains
access to the vault, as well all roles who have all generated
as their access rights access to this vault hyperlinks

13
Viewing action history

Select the vault via the Click on the “Actions” link and
pane on the left select “History”

The list that then appears displays all actions on the selected
vault with an indication of the user who performed them

14
Importing data into the vault
You can import passwords to the vault from a CSV or JSON file.

Select the vault you want Click on the “Actions” link and
from the left-hand pane select “Import Data”

Select a JSON or CSV file or paste data from the clipboard into the
appropriate text box. After that, Passwork will prompt you to select the
required data and ask you for an import destination.

15
Removing the vault

Select the vault you want to Click on the “Actions” link and
delete from the left-hand pane select “Delete”

In the window that appears, confirm the removing

Removing the vault will destroy the vault itself and any passwords
stored within it.

16
Working with folders
What is a folder?
A folder is effectively a password container. Using folders, you
can conveniently structure passwords within a vault by placing
thematically similar passwords in one folder. This makes it easier to
manage and use passwords.

Folders can be created not only inside the vault but also inside
other folders, without nesting restrictions. This allows you to
organize password hierarchies for your company.

Create a folder

To create a folder within a vault, simply click on the

“Actions” icon and select “Create folder”

17
Enter a name for the folder and When creating a folder, you can
click the “Save” button. set access levels for users. Click
A new folder will then be created the following link to expand
within the selected vault. access level settings.

By default, the user access levels for the new folder shall match those of
the parent vault

18
Rename a folder

Select the desired folder, click the “Actions” link

and select “Rename” from the menu

Enter a new name for the folder and click “Save”

19
Copy folder
Copying a folder allows you to copy a folder and its contents to
another vault or folder.

Select the desired folder, click the “Actions” link

and select “Copy” from the menu

Select the vault or folder where Copying a folder automatically

you want to copy the previously copies over user permissions
selected folder to and click the from the original folder
“Save” button

20
Moving a folder

To move a folder, select it and click the “Actions” link.

Then select “Move” from the menu that appears.

Select the vault or the folder where you want to move the
previously selected folder to (its name is displayed in the title of
the window), and click the “Save” button

However, there is another option for moving a folder: hover the

cursor over the folder’s icon in the main window, and then drag the
folder to a different location on either the main window or the left
pane.

21
Adding users to a folder
Adding users to a folder is similar to adding users to the vault.
The difference is that the added users only have access to the
passwords stored in the folder specified and not the vault as a
whole.

In the required folder, click the “Add to folder” button and select “Invite”

The “Give access to the whole vault” option gives the user
access rights to the entire parent vault of the folder, including
other folders within the vault

If you need to add several users to a folder at once, it is convenient

to use the hyperlink invitation option.

22
View folder permissions

Select a folder from the left pane or from the main window and click
the “Actions” link before selecting “Permissions”

The “Users in folder” tab The “Roles” tab The “Links”

displays all users who have displays all roles that tab contains
access to the specified have access to the all generated
folder, as well as their folder hyperlinks
access rights

23
Importing data into a folder
You can import passwords to a folder from a CSV or JSON file.

Select the desired folder from the left-hand pane or from the main window
and click the “Actions” link. From the menu, select “Import data”.

Select a JSON or CSV file or paste delimited data from the clipboard into
the appropriate text box. After that, Passwork will prompt you to select the
required data and ask you for an import destination.

24
Deleting a folder
Deleting a folder will destroy the folder itself and all passwords
stored within it.

Select the desired folder from the left-hand pane or from the main window
and click the “Actions” link. Select “Delete” from the menu that appears.

In the window that appears, confirm the delition

25
Working with passwords
Adding a password

To add a password, select the required vault or

folder and click the “Add password” button

Fill in the password’s name, The security level of the

username and password, the password is displayed as a
URL authorization form, and any colored line directly below the
other relevant fields password’s text field

26
Password edit

Select a password from the main window and click the “Edit password” link

The password edit window will appear, where

you can change all the applicable fields

27
Search for a password

To quickly find the password you want, enter keywords or tags into the
search bar or choose the colors and tags you want. Passwork will then
display all matching passwords.

For quick searches, Passwork creates its own secure indexes for
each password. You can reindex passwords in the “Company
settings” section:

28
Clipboard

To copy the login and password data to the clipboard, you’ll first
need to select a password. In the password window that appears,
click the copy to clipboard button.

However, there is another option for copying to the clipboard:

Right-click on the required password and select what you

want to copy, be it login or password information

29
Copy password

To copy the password to another vault or folder, select the password

from the main window, click the “Actions” link and select the “Copy”
item from the menu

Select another vault or folder The copied password inherits the

access rights of the folder or vault
where the password is copied to

30
Move password

To move the password to another vault or folder, select the password

from the main window, click the “Actions” link and select the “Move”
item from the menu

Select another vault or folder The moved password inherits the

permissions of the folder or vault
where it was moved to

31
However, there is another option for moving the password:

Hover your cursor over the password icon in the main window and drag the
password to a different location on either the main window or the left pane

Providing password access

Passwords shared with you will Select the password in the main
appear under “Shared with me” in window and click “Share” in
the left pane the window that appears. You
can give the user access to the
password via email or hyperlink.

32
Viewing a history of actions

Select a password on the main window and in the window that appears,
open the “History of actions” tab. The list displays recent actions regarding
the selected password.

To view a full history of password actions, click the “Actions” link and
select the “History” menu item

33
The list that then appears displays all actions on the selected
password with an indication of the user who performed them

Viewing password editions

The administrator of the vault can view the entire history of
password changes using the “Editions” command.

Select a password from the main To view the password in one

window and in the window that version or another, click the
appears, open the “Editions” tab. “View” link
Passwork will display all revisions
of this password.

34
Adding a password to “starred”

To add a password to “starred”, select a password in the main window and in

the window that appears, click the button “Add password to starred”

All “starred” passwords are stored in the corresponding

section on the left-hand pane

35
Remove password

Select a password from the main window. In the window that appears,
click the “Actions” link and select the “Delete” item from the menu.

In the window that opens, confirm that you wish to remove this password

36
User management
General principles
In Passwork, each user has certain levels
of access to passwords, as well as the ability to administrate, i.e.
attain access to user management settings.

For the convenience of assigning typical access rights to vaults and

folders, there are “user roles” in Passwork.

All actions related to users are carried out via the user management
panel:

You can go to the user management panel by clicking

the link next to the name of the organization

37
Viewing a list of users

Click “User Management” if you want to see a specific user list

The user management panel will then appear. Here, you

can create and manage users, as well as roles.

The user list displays all Passwork users, their roles and statuses.
Read more about user statuses in the “User creation” section.

38
The “Add filter” button allows you Click on a user in the list to open
to filter the list of users, showing up user properties. You’ll then see
only administrators, only users, the folders and vaults to which
and/or only certain roles the user has access

Here you can block, edit and delete a user, reset his
password, set access rights and apply the role.

A blocked user will no longer have access to any passwords. You

can restore access by clicking the “Activate” button.

39
User creation

From the “User management” panel, click the “Create users” button

Fill in the login information, select the status and user role,
before adding their email. Then, click “Save”.

Administrator status allows you to configure access rights for

users and roles, and also provides access to LDAP/ SSO settings,
Passwork settings, the security panel, the history of actions and
allows one to import and export passwords.

40
Edit users

Select a user from the list on the “User management” panel and then click
“Edit user” in the right-hand menu on the user control panel that appears

Edit the relevant user settings and then click “Save”

41
Setting up access rights

To grant access to a specific folder or vault, open the “User management”

panel, then, select a user from the list. In the open user control panel, click on
the drop-down menu in the “Access” column.

Select the access level for this user. The user will be
notified that he has been granted access.

42
You can also change the settings for accessing a folder or vault via
the “Permissions” window of a folder or vault:

Click on the “Actions” link and select “Permissions”

To change the access level or to delete a user, open

the drop-down list and select the required item

43
Applying roles

To apply a role to a user, Then click “Apply roles” in

check it on the list the right-hand menu

In the window that appears, select the roles that you

want to apply to the user and click “Save”

44
To exclude a user from a certain Click the link “Remove from roles” in
role, check him on the list the right-hand menu

Choose which roles no longer belong to the user and click “Save”

45
Invites

To register users in the system, Create invitations and send

copy the invitation link and send codes to users, which upon
it to the relevant employees interaction, will automatically
add them without a registration
confirmation

In the invitation creation window, fill in the title, specify the validity
period for the code, and select the roles. To generate a code, click the
“Create invite code” button and copy it to the clipboard. Please note
that the code will not be available after you close this window.

46
Working with roles
What are roles?
“Roles” is effectively a user management tool that allows you to
configure access rights to specific vaults and password folders for
multiple users at once.

You can create an unlimited number of roles, configure specific

access rights for each and apply them to users.

Roles are managed in the user management section:

To manage roles, on the “User management” panel, go to the “Roles” tab

The “access rights” switch on the list of roles allows you to

temporarily revoke the access rights of the corresponding role.
All users with this role will automatically lose access to vaults and
folders associated with this role, unless they possess another role
which also grants access to those folders.

47
Role creation

Click “Create role” on the “Roles” tab on the user management panel

In the window that appears, enter the name of the role and click “Save”.
The new role will appear on the list of roles

48
Editing a role

Select a role from the “Roles” tab of the user management panel.
The “edit role” window will open.

Here, you can customize the access level that this role dictates,
add users to this role, and rename or delete the role

49
To change access to a single folder or vault, click the drop-down list in the
“Access” column and select the desired type of access

Check multiple folders or vaults Then, click “Set access” in the

in the list to change access to all right-hand menu
of them at once

Read more about access levels in “Setting up access rights” section.

50
To add users to a role, click the (+) button in the list of roles

Or, click the (+) button in the right-hand menu of the “role edit” window

51
Deleting roles

On the “Roles” tab of the user management panel, click the “Delete role”
button next to the role that you want to delete

Confirm deletion in the window that appears

52
Settings
Go to settings

To open the settings panel, click on the drop-down menu next to the name
of the organization and select the required settings item

Account settings

Here, you can change your email, name, and profile photo.
You can also disable email notifications when passwords are changed and
enable auto-logout after 10 minutes of inactivity.

53
Authorization & Two-factor authentication

Here, you can change the Passwork authorization password and

set up two-factor authentication using Google Authenticator.
Below this, you’ll be able to see a history of authorizations.

API Settings

Here, you can integrate your To get your private API key, enter
infrastructure with Passwork your authorization password and
using our API then click the “Continue” button

54
In the window that appears, For more information on the
your personal API key will be integration process, you can refer
generated to the guides

LDAP Settings

Here, you can configure LDAP integration settings

The process of setting up LDAP authorization is described in more

detail in the “LDAP Integration” section.

55
SSO Settings

Here you can configure the SSO integration of Passwork

with SAML identity providers

Company Info

Here, you can view information about the company, as well as view the
license key and upload a selection of Passwork license files

56
Passwork Settings

On the Passwork settings page, you can select the interface language,
specify maximum file size, and much more. Below, you can configure the
search and re-index all passwords.

Security dashboard

The security dashboard displays a summary of information about the security

of the Passwork system. All weak, old, and compromised passwords pop up
here. A weak password can be changed immediately by clicking on it from the
list.

57
Activity log

Events occurring within those vaults of which you are an administrator are
displayed here. After selecting an event, you can take a look at the author or
go to the password itself.

Export data

Here, you can export data in a CSV or JSON file format.

Exporting in JSON format will save the entire structure of vaults and folders.

58
Import data

Here, you can import data from a CSV or JSON file format

By uploading the file in JSON format, you will be able to

select specific data to import

59
LDAP Integration
Configuring an LDAP Integration
LDAP / AD integration allows users to log in to Passwork using
credentials from the LDAP / AD directory.

To enable LDAP authorization, To complete the integration,

activate the corresponding you must specify one or more
switch in the “LDAP settings” LDAP / AD servers by clicking
section the “Add server” button

The “Debug” button allows you to test the LDAP authorization process

60
The authorization result will be displayed in the status window

Click on the server from the list to edit its settings

You can also temporarily To delete a server, click the trash

deactivate the LDAP server, can icon on the corresponding
using the server activity switch row from the list

61
Server settings
To edit a server, click the gear icon next to the server’s name.

Specify an arbitrary server Specify the IP address or hostname of the

name to be displayed in Active Directory or LDAP server. When
Passwork using the LDAPS protocol, it should
be specified explicitly, for example,
ldaps://89.208.196.86:636

If you plan to use several LDAP/AD servers, then specify a code for each server
(letters and numbers). This code will be used in the user’s login after the @ (at)
sign. For example, if the server code is server1, then the user login will appear
as: user@server1

The server code must be unique. You can leave the server code empty, but this
will mean that all users who do not have a login code will be able to connect.
Leave the code blank, if you have one AD/LDAP server.

62
Mask setting

By default, LDAP uses a special string format (which contains login

and domain information in addition to other data) for authorization,
namedly DN (Distinguished Names). Using such a string as a login
is inconvenient. To solve this problem, Passwork uses a mask – a
template DN with a special token for the username. Passwork takes
the mask, replaces the token with valid user login, and passes this
string to LDAP.

Here, you can set up a mask The “Test” button allows you
for the Passwork user login to make sure that the mask
authorizes the user correctly

63
Sign-in restrictions
Here, you can define Active Directory user groups that have access to
Passwork. If the first option is selected, users of any group will be able to log in
to Passwork.

If the “Enable sign-in restrictions” toggle To load Active Directory

switch is on, you should configure the group groups, click the
selection parameters. In this case, log in to appropriate button
Passwork will be able to users who are at
least in one group from the list.

64
After authorization on the AD server, Passwork will load the list of
user groups:

In the list, select the groups whose users will be able to log in to Passwork
through LDAP. Then click the “Save” button.

65
Adding users
You can add users to Passwork by loading them from the Active
Directory:

Click the “Load users” button to authorize in the Active Directory server

66
Passwork will load users from AD and display them in the list:

Select which users you To add the selected users, click

want to add to Passwork the “Add selected users” button

User authorization data, as well as user email addresses, will be

added to the corresponding fields of the user profiles on Passwork.

67
Working with the
browser extension
The Passwork browser extension is a password-management
application that includes the following features:
• Access to all your passwords directly from the extension
• Automatic saving of data and filling out of authorization forms
• The addition and customization of passwords
• Searching by title, colors and tags
• A flexible password generation system
• Extension blocker with the use of a PIN

Installing the extension

You can install the extension from your browser’s extension store.
For the extension to work, you need Passwork version 4.3 or later
(update instructions).

68
Extension authorization

To get authorized
in the
extension, open up
the extension and
enter the URL of
your Passwork
server

The extension will redirect you to the login page. Enter your Passwork
account details in the authorization form that appears and confirm the login. If
authorization has been successful, a page with a corresponding message will
open.

69
Extension settings

To go to the settings
section, click on the
profile icon

If necessary, in the
settings section, you can
change the language of
the extension

The extension is
blocked by a four-digit
PIN-code, which can be
set in the corresponding
field

You can also set the

extension to auto-block
and specify the
blocking time

In addition, there is the

ability to change the color
of the extension’s theme

70
 To block an extension,
click the corresponding
button

The next time you try to

enter the extension, you
will need to enter your
PIN

If you have forgotten your PIN, click the “Log out” button, after
which you will need to be reauthorized in the extension.

71
List of vaults
Sections of the main screen “Organization vaults” and “Personal
vaults” present an ordered structure of storing passwords which
enables quick access.

Select the vault of which

you want to view the
contents

The extension will

display the contents of
the vault

To go to the
corresponding page
in the web version of
Passwork, click on the
“Open in web” link

72
Recent passwords

To view a list of
passwords that have
been recently used, go
to the “Recent” section

The list will show

recently used passwords
in a chronological order

73
Starred passwords

You can add a password

to “starred” by clicking
the corresponding
button on the
password’s card

To view your starred

passwords, go to the
“Starred” section

74
Search for a password

To quickly find the

password you want,
click on the search
bar. Passwork will
automatically search for
the domain of the site
you are on

If no URL was specified in the password, the extension will not be

able to find passwords by domain. In this case, use another search
method:

In the search bar,

enter the name of the
password you want

Or use filters

75
 The extension will show
all found passwords

Save password
When getting
authorized on
the site, the extension
will automatically offer
to save a new password

If you do not want the

extension to prompt you
to save your password,
click the “Never for
this site” button. In this
case, the extension
will add the site to the
ignored list, which
can be reviewed in the
extension’s settings.

76
Clipboard

To copy the data of the

required password, click
the “Copy” button in the
list of passwords or on
the card of a specific
password

In the window that

appears, copy over the
required data

77
Authorization on sites
The Passwork extension automatically recognizes authorization
forms and offers passwords found by domain.

Select the suggested password. The extension will

automatically fill out the authorization form and log in.

If the authorization prompt did not appear, you can use the context
menu:

Right click on the authorization form. In the menu that appears,

click the “Sign in using Passwork” button.

78
Passwork recognizes the site and finds suitable passwords.
After you select the required password, the extension will
automatically fill out the authorization form and log in.

There is another authorization option:

In the extension, select

the desired password
and click the “Quick
authorization” button

79
The extension will redirect you to the authorization page on the site,
automatically fill out the authorization form and log in

Password generator
The extension has a fully-fledged password generator. With its
help, you can generate a unique password of the required length
and characteristics. Then, you can immediately save it for the
required site.

In the extension’s menu,

click the “Password
generator” button

80
 In the window that
appears, set the
password length and
symbols required

The generated
password can be copied
to the clipboard or
used to create a new
password by clicking
the “Create password”
button

81
Create a new password
The Passwork extension automatically recognizes the entered
data in registration forms and offers to save it. In addition, a new
password can be created manually in the appropriate section:

In the extension, click

the “New password”
button

Fill in the password’s

name, the username
and password, URL and
other available fields

Complete the procedure

by clicking the “Save”
button

82
Password edit

You can edit the

password by clicking the
corresponding button
on the password card

In the editing window

that appears, you
will be able to change
all fields of the selected
password

83
Technical support:
passwork.pro/help
84