Password Manager App Overview

Password Manager

1. What it is

Password Manager gives your organization a shared vault for team credentials and a private vault for each employee’s own passwords. Entries are encrypted at rest, every access is audit-logged, and a built-in security engine flags weak, reused, or breached passwords.

• Enablement: Password Manager requires a license. An admin enables it from Admin → Apps → All Apps and configures it from the in-app Settings page.
• What it is not: Password Manager stores credentials your people use to sign in to other services. It does not replace your organization’s own single sign-on or authentication settings — those live in Admin → Security & Sign-On.

2. Standing it up

1. Go to Admin → Apps → All Apps, find Password Manager, and enable it.
2. Open Password Manager → Admin → Settings and review the defaults. At a minimum, decide whether employees may store personal passwords (on by default) and whether team passwords are enabled (also on by default).
3. If you want to let non-admin employees create team passwords, choose one or more groups under Who Can Create Team Passwords. Without this, only admins and app admins can create team entries.
4. Optionally, set a Default Password Expiry so new login entries are automatically given a rotation deadline.
5. Default categories (Wi-Fi Networks, Software Licenses, Team Accounts, API Keys, Vendor Portals, Social Media, Banking & Finance, Personal) are seeded automatically the first time someone opens the app. You can add custom categories from Admin → Categories.
6. Confirm the app is working: open Password Manager from the sidebar, create a test entry, and verify it appears in the vault.

3. How it fits together

Entry types

Every record in Password Manager is an entry with a type that determines which fields it carries.

• Password (the default) — a login credential with a username, password, optional URL, and optional one-time-password (TOTP) seed.
• Secure Note — freeform encrypted text with no username or password fields.
• Credit Card, Identity, API Credential, Bank Account, Software License — structured entries whose type-specific fields (card number, account number, license key, etc.) are stored as encrypted custom fields.

An entry’s type is fixed at creation and cannot be changed afterward.

Example: a “Guest WiFi” entry of type Password holds the network name as the title, the SSID as the username, and the passphrase as the password. It is set to Team visibility with Public access so everyone in the organization can look it up. Its expiry is set to 30 days, so the nightly sweep marks it expired and the owner gets a reminder to rotate it.

Personal vs Team

Every entry is either Personal (Personal Passwords) or Team (Team Passwords).

• Personal entries are private to the owner. No one else — including admins — can see, search, or access them.
• Team entries are visible to other people based on their access level and any per-person sharing grants.

A team entry’s access level is either Public (anyone in the organization with the app enabled can view it) or Restricted (only people or groups explicitly granted access can view it). Group-based access uses the same groups as the rest of MangoApps.

Ownership and sharing

Every entry has an owner — the person who created it. Owners can always view, edit, and delete their entries.

For team entries, the owner or any admin can grant View or Edit access to individual people (to open an entry to a whole group, add the group to the entry’s allowed groups on its edit form). Grants can carry an expiry date; a nightly sweep deactivates grants that have lapsed. Admins can also transfer ownership of a team entry to another person.

TOTP (one-time passwords)

Any Password entry can carry a TOTP seed — the same secret a 2FA authenticator app uses. Paste the setup key or the full otpauth:// URI from the site’s QR code, and the entry will generate rolling one-time codes directly on its detail page. Non-standard configurations (digit count, period, algorithm) are preserved from the URI.

Password history

When a login’s password is changed, the previous value is saved automatically. Up to 20 past passwords are kept per entry. Editors can reveal or restore a prior password from the entry’s detail page; every reveal is audit-logged.

Password Agent

When the Enable Password Agent setting is on, employees can look up, create, and rotate credentials through Ask AI in natural language. The agent uses semantic search, so a query like “wireless credentials” can find an entry titled “Guest WiFi”. The agent cannot reveal secrets to anyone who wouldn’t be able to see them through the app.

4. Running it

Reviewing security health (admin)

Go to Password Manager → Admin → Analytics. The Security Health panel analyzes all team login entries and flags:

• Weak passwords — passwords that score below the strength threshold.
• Reused passwords — the same password used on more than one entry.
• Stale passwords — passwords that have not been rotated in 180 days.
• HTTP URLs — entries whose URL uses unencrypted HTTP.

The Analytics page also shows total counts, access statistics for the last 30 days, the most-accessed team entries, and how many entries are expiring within 30 days.

Running a breach check (admin)

From the Analytics page, click Run Breach Check. This sends a background job that checks each team login entry against the HaveIBeenPwned database using k-anonymity (no passwords leave your server in full). Results are kept for up to 30 days and the page says when the check last ran; a password changed since is no longer listed. The page shows which entries were found in known data breaches and how many times each appeared.

Running a personal breach check

Any user can check their own vault from Password Manager → Security Checkup. This page runs the same security-health analysis (weak, reused, stale, HTTP) on the entries that user owns. A Run Breach Check button triggers a personal breach check that covers both the user’s personal and team-owned entries.

Reviewing who has access (admin)

Go to Password Manager → Admin → Access Review to see every team entry, its allowed groups, its access level, and every person who has been individually granted access. This answers “who can see X?” without opening entries one at a time.

Managing categories

Go to Password Manager → Admin → Categories. Categories organize entries and are visible in the vault’s filter bar. Eight system categories are seeded by default. Admins can add custom categories. A system category cannot be deleted; a custom category can only be deleted when no entries use it.

Importing passwords

Go to Password Manager → Passwords → Import (also accessible from the import icon). Upload a CSV file or paste text. The importer previews parsed rows before committing. Each import can process up to 500 rows. You choose whether imported entries are personal or team, and you can assign a fallback category or let the importer create categories from a column in the source file.

Exporting passwords

From the Passwords list, click Export. This downloads a CSV of the entries in the list you are looking at — its tab, search and category filter. The export is audit-logged and is gated by the same identity-verification requirements as revealing a single password.

The file holds every field of each entry, including card numbers, API keys, account numbers and other concealed fields, so you can use it as a backup. Importing it brings back each password, secure note, card, identity, API credential, bank account and software license with its kind and all of its fields. Expiry dates are not carried over (the organization’s rotation policy applies to imported passwords), and categories named in the file are created only when an administrator imports it. Keep the file as safe as the vault itself, and delete it once you no longer need it.

Sharing a credential externally (admin, off by default)

When Allow External Secure-Share Links is turned on in Settings, admins can create an expiring, view-limited link for a team login or secure note that a non-MangoApps recipient (a vendor, a contractor) can open. Links expire after 1, 7 or 30 days (never later than the entry’s own expiry date) and allow 1, 3 or 5 views. The link landing page does not reveal the secret until the recipient explicitly clicks Reveal, so link-preview bots do not consume the view. Archived or expired entries can’t be shared this way. Turning the setting off stops every outstanding link being served but does not revoke them — they work again if it is turned back on, so revoke a link to end it for good. The entry’s External Share Links panel lists live links and the recent past ones, with how many views each used and when it was last opened.

Offboarding

When an employee leaves, the offboarding workflow automatically reassigns team entries they owned to their manager (or, if there is no manager or the manager can’t open Password Manager, to a business admin) and deactivates their inbound access grants. It also revokes any external share links they created, and tells the owner of each affected entry. Personal entries follow the account’s own lifecycle.

5. Settings

All settings are at Password Manager → Admin → Settings. Only admins and app admins can reach this page.

Setting	Default	What it changes
Enable Password Agent	On	Whether employees can manage credentials through Ask AI.
Allow Personal Passwords	On	Whether employees can create personal (private) vault entries.
Allow Team Passwords	On	Whether team (shared) entries can be created at all.
Show Password Strength Indicator	On	Whether the strength meter appears on entry forms and detail pages.
Mask Usernames	Off	When on, usernames are masked with dots in lists, search and the phone’s entry page; the desktop entry page still shows them.
Require 2FA to View Passwords	Off	When on, a user must have two-factor authentication enabled on their account to view any entry. Users without 2FA see a banner on the vault list and can’t reveal, copy or export passwords.
Require Identity Verification to Reveal Passwords	Off	When on, the platform’s step-up verification (the same 15-minute elevation used for sensitive HR data) is required before any password, TOTP code, or concealed custom field is revealed.
Allow External Secure-Share Links	Off	Whether admins can create expiring, view-limited links for sharing a team credential with someone outside MangoApps.
Let People With Edit Access Share a Team Password	Off	Off: only a team password’s owner and company administrators decide who can read it. On: anyone with edit access can grant and revoke access.
Default Password Expiry (Days)	0 (no expiry)	Number of days from creation until a new login entry expires. Entries past their expiry are marked expired by a nightly sweep and the owner receives rotation reminders at 7 days and 1 day before.
Audit Log Retention (Days)	365	How long the record of who opened, copied, created or edited each password is kept before the nightly cleanup removes it. Minimum 30.
Keep deletion and access-change records for (days)	2555 (7 years)	How long the record that a password was deleted, that a person was given or lost their own access to it, or that its owner changed is kept. Never shorter than Audit Log Retention. A change to which groups can see a team password is an edit and follows Audit Log Retention.
Max Personal Entries Per User	0 (unlimited)	Cap on the number of personal entries a single user may have. Applies at creation and at import; team entries are not counted.
Who Can Create Team Passwords	No groups selected (admins only)	Which employee groups are allowed to create team entries. Admins and app admins can always create team entries regardless of this setting.

6. More help

• Password Manager FAQ — specific questions about limits, troubleshooting, and day-to-day operations.
• Ask AI — the Password Agent answers questions and manages credentials from the AI sidebar.