Table of contents

• Introduction
• Existing solutions and their tradeoffs
• Our innovation: Obfuscated deterministic bloom filter indices
• Key benefits: Bridging the privacy-performance gap
• Real-world applications: Transforming password security
• Conclusion: A new era in password security

Introduction

Data breaches have become routine: millions of users worldwide face the consequences of compromised passwords. The scale is staggering: billions of credentials are exposed, fueling automated attacks and credential stuffing on a massive scale. Services like "Have I Been Pwned" now track over 12 billion breached accounts, and that number keeps growing.

Security professionals and users face a direct challenge: how can we check if a password has been compromised in a data breach without revealing the password itself to the checking service? The task sounds simple, but in reality, it requires a delicate balance between privacy, security, and performance.

Traditional approaches force a trade-off. Direct hash lookups are fast but unsafe: they expose the full hash, risking password leaks. More sophisticated cryptographic protocols offer strong privacy guarantees but come with significant computational overhead and implementation complexity that makes them impractical for many real-world applications.

We’re introducing a solution that bridges this gap: Private password breach checking using obfuscated deterministic bloom filter indices. This innovative approach provides strong privacy guarantees while maintaining the efficiency needed for practical deployment in password managers, authentication systems, and enterprise security infrastructure.

Existing solutions and their tradeoffs

To understand the significance of our new approach, it's important to examine the current methods for password breach checking and their inherent limitations.

Direct hash lookup: Simple but insecure

The earliest password breach checking services, such as LeakedSource, employed a straightforward approach: users would submit the SHA-1 hash of their password, and the service would check if that exact hash appeared in their breach database. Although simple to deploy and very fast to apply, this method is insecure and prone to potential attacks.

When a user submits their password hash directly, they're essentially handing over a cryptographic fingerprint of their password to the service. This creates several attack vectors: malicious actors could perform rainbow table attacks against the submitted hash, launch focused dictionary attacks targeting that specific hash, or correlate the same password across multiple services. The fundamental problem is that the hash itself becomes a valuable piece of information that can be exploited.

K-anonymity: A step forward with remaining vulnerabilities

Recognizing the security issues with direct hash submission, Troy Hunt introduced the k-anonymity approach for the "Have I Been Pwned" service, which has since been adopted by major companies including Cloudflare and Microsoft. This method represents a significant improvement in privacy protection while maintaining reasonable performance characteristics.

In the k-anonymity approach, instead of sending the full password hash, the client computes the SHA-1 hash of their password and sends only the first 5 hexadecimal characters (representing 20 bits) to the server. The server then returns all hashes in its database that begin with that prefix, typically between 400 and 800 hashes. The client then checks locally whether their full hash appears in the returned list.

This approach offers several advantages: it's simple to implement, provides reasonable privacy protection, and uses bandwidth efficiently. However, recent security analysis has revealed significant vulnerabilities. The method still leaks 20 bits of entropy about the password, and research has demonstrated that this partial information can increase password cracking success rates by an order of magnitude when attackers have access to the leaked prefixes. The approach is particularly vulnerable to targeted attacks against highvalue accounts, where even partial information can be valuable to sophisticated adversaries.

Cryptographic protocols: Strong privacy at a high cost

At the other end of the spectrum, advanced cryptographic protocols offer robust privacy guarantees but come with substantial implementation and performance costs. Two primary approaches have emerged in this category: Oblivious Pseudorandom Functions (OPRF) and Private Set Intersection (PSI).

The OPRF approach, used in Google's Password Checkup service and Apple's iCloud Keychain, employs a sophisticated cryptographic dance. The client first "blinds" its password hash using a random value, creating a masked version that reveals nothing about the original password. The server then applies a pseudorandom function to this blinded value without learning anything about the underlying password. Finally, the client "unblinds" the result and checks if the final value exists in a pre-downloaded set of breached identifiers.

Private Set Intersection protocols take a different approach, using advanced cryptographic techniques like homomorphic encryption or garbled circuits. These protocols allow a client to learn the intersection of its password set and the server's breach database without either party revealing their complete set to the other.

While these cryptographic approaches provide excellent privacy guarantees with no information leakage, they come with significant drawbacks. They require complex implementations involving elliptic curve cryptography, impose high computational costs that can be 100 to 1000 times slower than simple hash operations, and in some PSI protocols, require substantial bandwidth for large breach sets. These factors make them impractical for many real-world applications, particularly those requiring real-time password validation or deployment on resource-constrained devices.

Local and offline approaches: Perfect privacy with practical limitations

Some organizations have opted for local or offline approaches to achieve perfect privacy. There are services like "Have I Been Pwned" that offer downloadable password lists, allowing organizations to download the entire breach database (approximately 25GB uncompressed, 11GB compressed) and perform searches locally. Organizations can also build local Bloom filters from these datasets, reducing storage requirements to around 860MB for 500 million passwords with a 0.1% false positive rate.

While local approaches provide perfect privacy since no network communication is required, they present their own challenges. Storage requirements can be prohibitive, especially for mobile applications. Keeping the local database synchronized with new breaches requires regular updates, and the approach is generally impractical for most enduser applications, particularly on mobile devices with limited storage capacity.

Our innovation: Obfuscated deterministic bloom filter indices

Our new algorithm represents a fundamental breakthrough in password breach checking by introducing a new approach that combines the efficiency of Bloom filters with sophisticated obfuscation techniques. The result is a system that provides strong privacy guarantees while maintaining the performance characteristics needed for real-world deployment.

Understanding bloom filters: The foundation

To understand our approach, it's helpful to first grasp the concept of a Bloom filter. A Bloom filter is a space-efficient probabilistic data structure designed to test whether an element is a member of a set. Think of it as a highly compressed representation of a large dataset that can quickly answer the question "Is this item definitely not in the set?" or "This item might be in the set."

The beauty of Bloom filters lies in their efficiency. Instead of storing the actual password hashes, a Bloom filter represents the breach database as a large array of bits. When a password hash is added to the filter, multiple hash functions are applied to generate several index positions in the bit array, and those positions are set to 1. To check if a password might be compromised, the same hash functions are applied to generate the same index positions, and if all those positions contain 1, the password might be in the breach database.

The probabilistic nature of Bloom filters means they can produce false positives (indicating a password might be breached when it actually isn't) but never false negatives (they will never miss a password that is actually breached). This characteristic makes them perfect for security applications where it's better to err on the side of caution.

The core innovation: Deterministic obfuscation

The key insight behind our algorithm is that while Bloom filters are efficient, directly querying specific bit positions would still reveal information about the password being checked. Our solution introduces a sophisticated obfuscation mechanism that hides the real query among carefully crafted noise.

The algorithm operates on a simple but powerful principle: when checking a password, instead of requesting only the bit positions that correspond to that password, the client also requests additional "noise" positions that are generated deterministically but appear random to the server. This creates a situation where the server cannot distinguish between the real query positions and the fake ones, effectively hiding the password being checked.

What makes this approach particularly elegant is the use of deterministic noise generation. Unlike random noise, which would create different query patterns each time the same password is checked, our deterministic approach ensures that checking the same password always generates the same set of noise positions. This consistency is crucial for both security and efficiency reasons.

How the algorithm works: A three-phase process

Our algorithm operates through three distinct phases, each designed to maintain privacy while ensuring efficient operation.

Phase 1: Server setup
The server begins by taking a comprehensive set of compromised password hashes from known data breaches. These hashes are then used to populate a large Bloom filter bit array. For each compromised password hash, multiple hash functions are applied to generate several index positions in the bit array, and those positions are marked as 1. The result is a compact representation of millions or billions of compromised passwords that can be queried efficiently.

Phase 2: Client query generation
When a client wants to check a password, the process begins by computing a cryptographic hash of the password. The client then generates two sets of indices: the "true indices" that correspond to the password being checked, and "noise indices" that serve as decoys.

The true indices are generated by applying the same hash functions used by the server to the password hash. These are the positions in the Bloom filter that would need to be checked to determine if the password is compromised.

The noise indices are generated using a pseudorandom function keyed with a secret that only the client knows. This secret ensures that the noise appears random to the server but is deterministic for the client. The number of noise indices is carefully chosen to provide strong privacy guarantees while maintaining efficiency.

Once both sets of indices are generated, they are combined and shuffled in a deterministic but unpredictable manner. This shuffling ensures that the server cannot distinguish between real and fake indices based on their position in the query.

Phase 3: Query processing and response
The client sends the shuffled set of indices to the server, which responds with the bit values at each requested position. The server has no way to determine which indices correspond to the actual password being checked and which are noise.

Upon receiving the response, the client examines only the bit values corresponding to the true indices. If any of these positions contains a 0, the password is definitively not compromised. If all true index positions contain 1, the password may be compromised, though there's a small possibility of a false positive due to the probabilistic nature of Bloom filters.

The power of deterministic noise

The deterministic nature of our noise generation provides several crucial advantages over alternative approaches. When the same password is checked multiple times, the exact same query is sent to the server each time. This consistency prevents correlation attacks where an adversary might try to identify patterns across multiple queries for the same password.

In contrast, if random noise were used, repeated queries for the same password would generate different noise patterns each time. A sophisticated adversary could potentially analyze multiple queries and identify the common elements, gradually narrowing down the true indices. Our deterministic approach eliminates this vulnerability entirely.

The deterministic noise also provides computational efficiency benefits. Since the same password always generates the same query, clients can cache results, and the system can optimize for repeated queries without compromising security.

Key benefits: Bridging the privacy-performance gap

Our algorithm delivers a unique combination of benefits that address the fundamental challenges in password breach checking, offering a practical solution that doesn't force users to choose between privacy and performance.

Strong privacy guarantees

The algorithm provides robust privacy protection through several mechanisms. The deterministic obfuscation ensures that queries for different passwords are computationally indistinguishable to the server. Even with access to vast computational resources and knowledge of common passwords, an adversarial server cannot determine which password is being checked based solely on the query pattern.

The system is specifically designed to resist correlation attacks, where an adversary attempts to learn information by analyzing multiple queries over time. Because the same password always generates the same query pattern, repeated checks don't provide additional information that could compromise privacy. This stands in stark contrast to systems using random noise, where multiple queries for the same password would eventually reveal the true query pattern.

Operating under an honest-but-curious threat model, the algorithm assumes the server will follow the protocol yet may attempt to extract information from observed queries. Our approach ensures that even a sophisticated adversary with access to public breach databases and the ability to store and analyze all queries over time cannot extract meaningful information about the passwords being checked.

Exceptional performance characteristics

One of the most compelling aspects of our algorithm is its performance profile. Experimental evaluation demonstrates that the system achieves sub-millisecond query times, making it suitable for real-time password validation scenarios. This performance is achieved through the efficient nature of Bloom filter operations and the streamlined query process.

The bandwidth overhead is minimal, typically requiring less than 1KB per query. This efficiency makes the algorithm practical for mobile applications and environments with limited network connectivity. The low bandwidth requirements also reduce server costs and improve scalability for service providers.

The computational overhead on both client and server sides is minimal. Clients need only perform basic cryptographic hash operations and simple bit manipulations. Servers can respond to queries with straightforward bit array lookups. This simplicity stands in stark contrast to cryptographic protocols that require complex elliptic curve operations or homomorphic encryption computations.

Scalability and practical deployment

Built for real-world deployment, the algorithm ensures that server-side infrastructure can efficiently process millions of concurrent queries while keeping response times consistent. The Bloom filter representation allows for compact storage of massive breach databases, making it economically feasible to maintain comprehensive breach checking services.

The system supports easy updates as new breaches are discovered. New compromised passwords can be added to the Bloom filter without requiring changes to the client-side implementation or forcing users to update their software. This flexibility is crucial for maintaining up-to-date protection against emerging threats.

Robust resistance to denial-of-service attacks is another advantage. The lightweight nature of query processing means that servers can handle high query volumes without significant resource consumption. Because queries are deterministic, effective caching can further boost performance and reduce server load.

Compatibility and integration

Our approach is designed to integrate seamlessly with existing security infrastructure. The algorithm can be implemented as a drop-in replacement for existing password breach checking mechanisms without requiring significant changes to client applications. Password managers, authentication systems, and enterprise security tools can adopt the algorithm with minimal modification to their existing codebases.

The system is compatible with various deployment models, from cloud-based services to on-premises installations. Organizations can choose to operate their own breach checking infrastructure using our algorithm while maintaining the same privacy and performance benefits.

The algorithm also supports various customization options to meet specific security requirements. Organizations can adjust the noise levels, Bloom filter parameters, and other configuration options to balance privacy, performance, and storage requirements according to their specific needs.

Real-world applications: Transforming password security

The practical benefits of our algorithm translate into significant improvements across a wide range of security applications and use cases. The combination of strong privacy guarantees and high performance opens up new possibilities for password security that were previously impractical or impossible.

Password managers: Enhanced security without compromise

Password managers represent one of the most compelling applications for our algorithm. These tools are responsible for generating, storing, and managing passwords for millions of users, making them a critical component of modern digital security. However, traditional password managers have faced challenges in implementing comprehensive breach checking due to privacy and performance constraints.

With our algorithm, password managers can now offer real-time breach checking for all stored passwords without compromising user privacy. When users save a new password or during periodic security audits, the password manager can instantly verify whether the password has appeared in known data breaches. This capability enables password managers to provide immediate feedback to users, encouraging them to change compromised passwords before they can be exploited.

The low latency and minimal bandwidth requirements make it practical to check passwords in real-time as users type them during password creation. This immediate feedback can guide users toward stronger, uncompromised passwords without creating friction in the user experience. The privacy guarantees ensure that even the password manager service provider cannot learn about the specific passwords being checked, maintaining the trust that is essential for these security tools.

Authentication systems: Proactive security measures

Modern authentication systems can leverage our algorithm to implement proactive security measures that protect users from credential-based attacks. During login attempts, authentication systems can check submitted passwords against breach databases in realtime, identifying potentially compromised credentials before they can be used maliciously.

This capability enables authentication systems to implement adaptive security policies. For example, if a user attempts to log in with a password that has been found in a data breach, the system can require additional authentication factors, prompt for a password change, or temporarily restrict account access until the user updates their credentials. These measures can significantly reduce the success rate of credential stuffing attacks and other passwordbased threats.

The algorithm's performance characteristics make it suitable for high-volume authentication scenarios, such as enterprise login systems or consumer web services with millions of users. The sub-millisecond query times ensure that breach checking doesn't introduce noticeable delays in the authentication process, maintaining a smooth user experience while enhancing security.

Enterprise security infrastructure: Comprehensive protection

Large organizations face unique challenges in password security due to the scale and complexity of their IT environments. Our algorithm provides enterprise security teams with powerful tools for implementing comprehensive password security policies across their organizations.

Enterprise security systems can use the algorithm to continuously monitor employee passwords against breach databases, identifying compromised credentials before they can be exploited by attackers. This monitoring can be integrated with existing identity and access management systems, automatically triggering password reset requirements when compromised credentials are detected.

The algorithm also supports compliance requirements by providing organizations with the ability to demonstrate that they are actively monitoring for compromised credentials. Many regulatory frameworks and security standards require organizations to implement measures for detecting and responding to credential compromise, and our algorithm provides a practical, privacy-preserving solution for meeting these requirements. For organizations with strict data privacy requirements, the algorithm's privacy guarantees ensure that sensitive password information never leaves the organization's control. This capability is particularly important for organizations in regulated industries or those handling sensitive personal information.

Consumer applications: Democratizing security

The efficiency and simplicity of our algorithm make it practical to implement in consumer applications that previously couldn't afford the overhead of comprehensive breach checking. Mobile applications, web browsers, and other consumer software can now offer enterprise-grade password security features without requiring significant computational resources or complex cryptographic implementations.

Web browsers can integrate the algorithm to provide real-time feedback when users create or update passwords on websites. This integration can help users avoid reusing compromised passwords across multiple sites, reducing their exposure to credential stuffing attacks. The low bandwidth requirements make this practical even on mobile networks with limited connectivity.

Consumer applications can also use the algorithm to implement security dashboards that help users understand and improve their overall password security posture. By checking all of a user's passwords against breach databases, these applications can provide personalized recommendations for improving security without compromising the privacy of individual passwords.

Service providers: Enabling privacy-preserving security services

Our algorithm creates new opportunities for service providers to offer privacy-preserving security services. Companies can build breach checking services that provide strong privacy guarantees to their customers, enabling new business models and service offerings that were previously impractical due to privacy concerns.

The algorithm's efficiency makes it economically viable to operate large-scale breach checking services. The low computational and bandwidth requirements reduce operational costs, making it possible to offer these services at scale while maintaining reasonable pricing. The ability to handle high query volumes also enables service providers to serve large customer bases without significant infrastructure investments.

Service providers can also offer the algorithm as a component of broader security platforms, integrating breach checking with other security services such as threat intelligence, vulnerability management, and security monitoring. This integration can provide customers with comprehensive security solutions that address multiple aspects of cybersecurity while maintaining strong privacy protections.

Conclusion: A new era in password security

The introduction of our Private password breach checking algorithm using obfuscated deterministic bloom filter indices represents a significant advancement in the field of password security. By successfully bridging the gap between privacy and performance, we have created a solution that makes comprehensive password breach checking practical for a wide range of applications and use cases.

The algorithm's key innovations — deterministic noise generation, efficient Bloom filter operations, and sophisticated obfuscation techniques — combine to deliver a system that provides strong privacy guarantees while maintaining the performance characteristics needed for real-world deployment. With sub-millisecond query times and minimal bandwidth overhead, the algorithm makes it possible to implement real-time password breach checking in applications ranging from consumer password managers to enterprise authentication systems.

The privacy guarantees provided by our algorithm are particularly significant in today's regulatory environment, where data protection and user privacy are increasingly important considerations. By ensuring that password information never needs to be revealed to checking services, our algorithm enables organizations to implement comprehensive security measures while maintaining compliance with privacy regulations and user expectations.

The practical impact of this technology extends far beyond technical improvements. By making privacy-preserving password breach checking accessible and efficient, we are enabling a new generation of security tools and services that can better protect users from the growing threat of credential-based attacks. The algorithm's compatibility with existing infrastructure and ease of implementation mean that these benefits can be realized quickly and broadly across the security ecosystem.

As cyber threats continue to evolve and data breaches become increasingly common, the need for effective password security measures will only grow. Our algorithm provides a foundation for building more secure, privacy-preserving systems that can adapt to meet these challenges while maintaining the usability and performance that users expect.

The development of this algorithm represents just the beginning of our work in privacypreserving security technologies. We are committed to continuing research and development in this area, exploring new applications and improvements that can further enhance the security and privacy of digital systems.

We believe that the future of cybersecurity lies in solutions that don't force users to choose between security and privacy. Our Private password breach checking algorithm demonstrates that it is possible to achieve both goals simultaneously, providing a model for future innovations in security technology.

For organizations and developers interested in implementing this technology, we encourage you to explore the detailed technical specifications and implementation guidance provided in our comprehensive research paper. The paper includes formal security analysis, detailed implementation recommendations, and comprehensive performance evaluations that provide the foundation for successful deployment of this algorithm in production environments.

Kindernothilfe (KNH) is a German non-profit organization dedicated to supporting vulnerable children in impoverished and underprivileged regions worldwide. Founded in 1959, it has made significant contributions as one of Europe’s largest charities dedicated to child aid. Operating in over 30 countries, Kindernothilfe emphasizes the importance of ensuring children’s rights and providing access to education, healthcare, child protection, and community development initiatives, all aimed at enhancing children’s living conditions and eradicating poverty.

The challenge: Finding a secure and user-friendly solution for global teams

Before choosing Passwork, Kindernothilfe relied on KeePass, a solution that limited scalability and lacked user-friendly features essential for a globally operating organization. With over 300 employees across more than 30 countries, the organization required a secure, scalable, and intuitive password management solution.

Doing so was crucial to meet the growing demands of its international team, especially for enhancing password sharing and access management capabilities for remote employees.

The solution: Switching to Passwork for improved security and simplified user access

Kindernothilfe opted for Passwork for its robust self-hosting capabilities, ensuring optimal data control and security. The seamless integration with SAML2 for Single Sign-On (SSO) streamlined access management across multiple platforms.

Furthermore, Passwork’s intuitive interface, along with its mobile app and browser extension, made it possible to manage passwords effortlessly from any device. The secure password-sharing features enhanced team collaboration, significantly reducing human error and improving overall security protocols.

The implementation: Gradual rollout and building a secure infrastructure

The implementation process took approximately two months. It was primarily focused on establishing and thoroughly testing the infrastructure to ensure Passwork met Kindernothilfe’s security requirements. The integration of SAML2 for Single Sign-On (SSO) was smooth and completed within a short timeframe.

To facilitate the successful implementation of Passwork, Kindernothilfe opted for a phased rollout rather than deploying the password management solution organization-wide all at once. They began with a smaller group of employees to showcase the benefits of the system and gradually promoted its use.

While organizing various promotional and educational activities, such as “Lunch and Learn” events, the organization encouraged employees to engage with Passwork. The goal was to achieve the point where at least 50% of the staff actively used Passwork before expanding the system to the entire organization.

The results: Increasing operational efficiency for cross-border teams

Currently, approximately 50% of the staff are actively using Passwork—a centralized, secure, and user-friendly solution for password sharing. This incremental approach not only ensured higher user engagement but also significantly strengthened security protocols across the organization.

By improving password management processes, Kindernothilfe increased its overall operational efficiency, especially for cross-border teams. Educational initiatives, such as “Lunch and Learn” sessions, were instrumental in raising awareness about Passwork and facilitating its successful adoption throughout the organization.

Passwork 6.4, we have introduced a number of changes which enhance our browser extension security, make user permissions settings more flexible, and improve the logging of settings related changes:

• Mandatory extension PIN code
• Logging of all changes related to settings
• User access to history of actions with passwords
• Automatic updating of LDAP group lists

Mandatory extension PIN code

With the new setting ‘Mandatory PIN code in extension’, administrators can set a mandatory browser extension PIN code for all users, minimizing potential unauthorized access. Once enabled, users who have not yet set a PIN code will be prompted to do so upon their next login to the extension. Users will be able to configure their auto-lock timeout and change the PIN code, but they cannot disable these functions.

Logging of all changes related to settings

Now all changes in the Account settings, User management, LDAP settings, SSO settings, License info, and Background tasks are displayed in the Activity log.

History of actions with passwords

The new setting ‘Who can view the history of actions with passwords’ makes it possible for vault administrators to let other users view password history, password editions, and receive notifications related to their changes. Previously, these features were available only to vault administrators.

Automatic updating of LDAP group lists

Automatic updating of LDAP group lists can now be configured on the Groups tab in the LDAP settings. The update is performed through background tasks with a selected time interval.

Other improvements

• Added pop-up notifications when exporting data or moving data to the Bin
• Improved display of dropdown lists on the Activity log page
• Changed time display format of the ‘Automatic logout when inactive’ and ‘Maximum lifetime of the session when inactive’ settings
• Changed the Enabled / Disabled dropdown lists on the System settings and LDAP settings pages with toggles
• Increased minimum length of generated passwords to six characters

Bug fixes

• Fixed an issue in the Password generator where selected characters were sometimes missing in the generated password
• Fixed an issue where local users could not independently recover their account password when an LDAP server was enabled
• Fixed an issue where local users could not register in Passwork when an LDAP server was enabled
• Fixed an issue which occurred after moving a folder with shortcuts to another vault and shortcuts not being displayed in the new vault
• Fixed an issue that occurred when trying to move a shortcut found in search results without opening any vaults right after logging into Passwork
• Fixed an issue that occurred when trying to copy a password found in search results without opening any vaults right after logging into Passwork
• Fixed an issue that occurred when a password was sent to another user and remained on the recipient's Recents and Starred pages after the initial password was moved to the Bin
• Fixed the value in the time field for the ‘API key rotation period (in hours)’ setting which was reset to zero after disabling it
• Fixed incorrect event logging in the Activity log after changing folder permissions
• Fixed incorrect text notification about assigning access rights to a user through a role
• Fixed incorrect tooltip text when hovering over the username of a recently created user
• Fixed incorrect display of long invitation titles
• Removed the local registration page when the LDAP server is enabled

In Passwork 6.3, we have implemented numerous changes that significantly improve organization management efficiency, provide more flexible user permission settings, and increase security:

• Administrative rights
• Hidden vaults
• Improved private vaults
• Improved settings interface

Administrative rights

Available with the Advanced license

Now there is no need to make users administrators in order to grant them specific administrative rights. This option is a response to one of the most frequent requests from our customers.

Administrators can grant only those rights or permissions that are necessary for users to fulfill their duties and flexibly customize access to settings sections and manage Passwork. For instance, you can grant employees the right to create and edit new users, view the history of user activity, track settings changes, while restricting access to organization vaults and System settings.

You can configure additional rights on the Administrative rights tab in User management. There are four settings sections to flexibly customize Passwork for your business:

General

In this section, you can grant users access rights to manage all existing and new organization vaults, view the history of actions with settings and users, access license info and upload license keys, view and modify the parameters of SSO settings and Background tasks.

User management

In this section, you can grant users access rights to view and modify User management parameters. This includes performing any necessary actions with users and roles, such as creating, deleting, and editing users, changing their authorization type and sending invitations.

System settings

In this section of settings, you can grant users the right to view and modify specific groups of System settings.

LDAP settings

In this section, you can grant users the right to view and modify LDAP parameters which include adding and deleting servers, registering new users, managing group lists, viewing and configuring synchronization settings.

Activity log

The event of changing user administrative rights has been added to the Activity log. All changes are now recorded in the Activity log, that includes the users who initiated such changes as well as each setting that was modified with its previous and current values.

Interface improvements

Users with additional administrative rights are marked with a special icon next to their user status.

Some items remain unavailable until the necessary settings have been activated. When hovering your cursor over such items, a tooltip with information regarding dependent settings will be displayed.

Hidden vaults

In the previous versions of Passwork only organization administrators were able to hide vaults. Also, only organization vaults could be hidden. In this new version, all users can hide any vaults. Hiding makes vaults invisible only to the users who choose to do it and does not affect others.

Hidden vault management is now carried out in a new window, which is available directly from the list of vaults. You can view the list of all available vaults and customize their visibility there.

Private vault improvements

Displaying private vaults in User management

Besides hiding private vaults, employees with User management access can now see all vaults which they administer (including private vaults). The new feature which makes it possible to add users to private vaults has also been added to User management.

Logging of events in private vaults

Private vault administrators can view all events related to their vaults in the Activity log.

Other changes

• Fixed an issue which prevented users from changing their temporary master password
• Fixed an issue which prevented users from setting the minimum length for authorization and master passwords
• Fixed an issue in User management which made administrator self-deletion possible
• Minor improvements to the settings interface

In Passwork 6.2 we have introduced a range of features aimed at enhancing your security and convenience:

• Bin
• Protection against accidental removal of vault
• Protection against 2FA brute force
• Accelerated synchronization with LDAP
• Improved API settings
• Bug fixes in role management

Bin

Now, when deleting folders and passwords, they will be moved to the Bin. If needed, they can be restored while preserving previously set access permissions. Vaults are deleted without being moved to the Bin — they can only be restored from a backup.

Who can view deleted passwords and folders in the Bin?

Inside the bin users can see the deleted items from those vaults in which they are administrators. For instance, an employee who is not an administrator of organization vaults will only see the deleted passwords and folders from his personal vaults when opening the Bin.

In addition to object names, the Bin also displays the usernames of people who deleted data. You can also see the initial directory name and the deletion date.

Object restoration

Objects from the Bin can be restored to their initial directory if it has not been deleted or moved. Alternatively, you can choose any other directory where you have edit and higher access levels.

When restoring deleted folders to their initial directories, user and role access levels will also be restored exactly as they were previously manually set in these folders. Other access permissions will be set based on the current permissions in the initial directory.

When restoring folders to a directory different from the initial, access levels will always depend on the current permissions in the selected directory.

Additional access to deleted passwords

If passwords have been shared with users, moving them to the Bin will remove them from the “Inbox” section, and any shortcuts or links to these passwords will become nonfunctional.

Restoring additional access

When restoring from the Bin, it is possible to regain additional access levels to passwords. Passwords that were shared with users will reappear in their “Inbox” section, access to passwords through shortcuts will be restored, and links that have not expired will become functional again.

Bin cleanup

You can delete selected items from the Bin or use the "Empty Bin" button to remove all items contained inside.

It's important to note that in the Bin you only see the items which were deleted from the vaults where you are an administrator. Objects from other vaults are not visible, and clearing the Bin will not affect them.

In future, the option to configure automatic Bin cleanup will be added.

Protection against accidental removal of vault

To confirm the deletion of a vault, you now need to enter its name. It will be permanently deleted along with all the data inside. Additionally, if there are passwords or folders from this vault in the Bin, they will also be removed.

Protection against 2FA brute force

Protection against 2FA brute-force attacks has been added. After several incorrect attempts to enter the 2FA code, the user will be temporarily locked. The number of attempts, input intervals, and the lockout time are set in the config.ini file.

Other changes

• LDAP synchronization has been accelerated
• Descriptions of parameters and minimum allowable values for API token expiration time and API refresh token expiration time have been added to the API settings section
• Automatic assignment of "Navigation" to parent folders in role management has been fixed
• The issue when a vault administrator could not add roles to a vault and manage its permissions has been fixed
• The issue with showing additional access rights to passwords when moved to another vault has been fixed

Upgrade Instructions — How to update Passwork
More information about features and prices — on the Passwork website

This latest update demonstrates our focus on refining user experience and enhancing collaborative password management.

No longer will you need to create password copies in various vaults — we've introduced shortcuts. With these handy labels, you can easily organize access to passwords from different directories.

The new enhanced settings provide administrators with more control over configurations and user rights, and all changes require approvals, preventing any unintentional actions.

LDAP user management has now become simpler with its cleaner interface and background data updates.

In addition to that, Passwork 6.0 brings new notifications and interface improvements. All these enhancements contribute to a more comfortable user experience while ensuring the security of passwords and sensitive data.

Shortcuts

Shortcuts are a new way to share passwords, enhancing collaboration flexibility. There's no need for creating password duplicates in different vaults — instead, create multiple shortcuts in required directories. All changes to original passwords are reflected in shortcuts, keeping your team up to date. Users can view or edit data via shortcuts according to their access rights.

Sending passwords without granting partial access to vaults

Previous versions of Passwork encrypt passwords at the vault level. This type of encryption gives users partial access to vaults even when a single password is shared with them. Now, when users access passwords via their "Inbox" or a shortcut, they receive keys to specific passwords, but not their vaults.

Administrators can clearly see who has vault access rights, and who can only work with specific passwords.

LDAP

The LDAP interface is now cleaner and more intuitive, with a reimagined user management logic. Adding new LDAP users is simpler and safer, especially with the client-side encryption enabled.

Previously, admins had to add an employee and provide a master password. Now, users set their master passwords upon the first login, and admins confirm them afterwards.

The "Users" tab shows registered users, and there is a separate window for adding new ones. LDAP user data updates take place in the background, allowing admins to navigate elsewhere without waiting for data refresh.

Passwork now provides more detailed security group information. The groups that are linked to roles are marked with special tags, and the groups which were not loaded from LDAP during the last update are marked as "Deleted", alerting admins to adjust the search settings or remove such groups. Also, you can now see the members of each security group.

Improved settings

We've redesigned all settings sections for a unified visual style and enhanced functionality, reimagined the logics of some settings.

Rights for links, tags, and password sharing. Previously, these settings were applied individually to each user. Now, they are applied to everyone with a certain level of vault access. For example, anyone with the “Edit” access rights or higher can create hyperlinks to passwords. These parameters are located in the system settings under the “Global” tab.

Change confirmation. We've added “Save” and “Cancel changes” buttons in system settings. Now, any changes to settings must be confirmed — this helps to prevent accidental actions.

Custom auto-logout time. Users can now set these parameters individually, and admins specify the maximum inactivity time period before automatic logout.

Language selection. In the new version of Passwork, admins can allow employees to choose their interface language.

Interface enhancements

Improved drag and drop. Now, when dragging and dropping passwords and folders into desired directories, Passwork displays selectable actions — move, copy, or create a shortcut.

Other improvements

Separate windows for access to the safe and additional access. Vault access info is now split into two easy-to-read windows. One window shows users who has access to a specific vault, and the other displays alternative ways passwords from this vault can be accessed — shortcuts, hyperlinks, or shared passwords.

Redesigned password action buttons. On the password panel, we've added the "Edit" button and grouped together all actions for additional password access via shortcuts, links, or direct user sharing.

Additional fields for password import and export. Passwork 6.0 supports the use of custom fields, that means you can transfer not only login and password but also additional information stored within password cards.

New notifications. Administrators will receive notifications about new unconfirmed users, and employees will be notified of new passwords in the "Incoming" section.

In the new version of Passwork, we have completely redesigned the System settings. They are now divided into three sections:

1. Global — organization settings that determine the operations of most of the Passwork functions
2. Default — the values of the settings that will be used if no other custom settings are specified
3. Custom — settings that can be set for individual users and roles

Now you can set up different interface languages, configure authorization methods, and enable mandatory two-factor authentication for individual users and roles.

To do this, click "Create a new settings group" in Сustom settings, add users or roles and select your desired settings. The newly created group will be added to the top of the list and will get the highest priority.

The following settings are now available:

• Ability to create organization vaults and private vaults
• Ability to create links to passwords
• Mandatory 2FA
• Time of automatic logout when inactive
• Authorization method (by local password, LDAP password or SSO)
• API usage
• Interface language

We're already working to add new settings.

If you are already using Passwork — update your Passwork
Or request a free demo at passwork.pro

Running tasks in the background

A new mechanism for handling tasks allows you to run them in the background. For example, you can run an LDAP synchronization task and still work in Passwork. Your synchronization task will run in the background.

You can see scheduled and completed tasks on the “Tasks” page. Here you can also find the configuration instructions for your operating system.

Display a favicon in the password list

The Passwork interface has become even more user friendly and convenient. If a password has a URL, a website icon will be displayed next to its name.

Automatic favicon loading can be set up by administrators on the “Company settings” page. In this case background tasks should be set up.

Other changes:

• Automatic session termination in the mobile app and Passwork extension when API key is changed
• Removed white background in the dark theme when loading pages
• Fixed bug displaying the results of an outdated search query
• Improved validation of TOTP keys
• Fixed empty messages in Syslog
• Added login validation with UTF-8 encoding
• Added automatic LDAP host swap :\\ → ://
• Fixed errors in LDAP code related to the migration to PHP 8
• Redesigned login and registration forms

If you are already using Passwork, update your version — How to update Passwork
Or request a free demo at passwork.pro

Migration to PHP 8

The new version of Passwork now runs on PHP 8. Previous versions of PHP are no longer supported.

New access rights window

The window with access settings for vaults and folders has been completely redesigned. All users and roles having access to a vault or folder are now collected here as well as links and sent passwords.

The rights can now be edited on each tab by selecting multiple objects at once. All modified and deleted objects are marked by an indicator until you save changes. Search filters allow you to display all objects with a certain access right.

Ability to quickly view who accessed vaults and folders

When hovering over an icon next to the name of a vault or folder you can see some brief information about the number of users, roles, links and sent passwords.

Clicking on a list opens up the window for access rights management inside a given vault or folder.

Granting access to individual passwords without adding users to a vault

In previous versions of Passwork, it was possible to send a password copy to users. In the new version, users will see the original password in the Inbox, which will be updated when the original vault changes.

That means you can now give access directly to a password without adding users to a vault or folder.

You can send a password and enable users to edit it, then when a user changes this password, it will be updated for you as well.

Ability to add TOTP keys and then generate 2FA codes

When adding and editing a password, you can add a TOTP field and enter a secret code to generate 2FA codes. The generated code is updated every 30 seconds.

The "Password" field is now optional, so you can keep 2FA codes separate from main passwords.

Adding TOTP keys and generating 2FA codes is available in the web version, browser extension, and mobile app.

Failed login attempts are now displayed in the action history

The action history displays all failed user authorization attempts. This allows you to better track unauthorized access attempts and the actions of blocked users.

You can see all failed login attempts on the Activity Log page by enabling a filter in the Action column.

Ability to enable priority authorization using SSO

The new version of Passwork now allows you to enable SSO priority authorization for all users. You can enable it in the "SSO settings" section.

With this option enabled, only the "Sign in via SSO" button is displayed on the authorization page, the login and password fields appear only when switching to the standard authorization.

Optimized work with a large number of users

Passwork has been tested and optimized for 20,000+ users.

Improved LDAP integration

• Test mode for LDAP roles and groups linking
• Saving LDAP logs to a CSV file
• Updating user attributes during synchronization with LDAP directory

Mobile app update

• Passwork 5 support
• Ability to copy passwords on long press
• New home screen view with separating by type of vault
• Inbox passwords
• Improved search mechanism
• Debug mode

If you are already using Passwork, update your version
How to upgrade Passwork 4→5 version.

Or request a free demo at passwork.pro.