The first public release of PassZit, a free, self-hosted password manager with end-to-end encryption for people and teams.
Highlights
- End-to-end encrypted vaults: keys come from the master password (Argon2id), and every item is sealed with AES-256-GCM in the browser. The server never sees a key.
- Web vault: websites, remote connections (RDP, SSH, WinSCP, WinBox, VNC, Telnet), SSH keys, notes, cards and identities. It also has one-time codes (TOTP, read from a QR code too), attachments, nested folders (customer, site, branch, department, data center, network, project) and search across all vaults. Double-click an item to open it.
- Unlock once: the web vault and the browser extension share the unlocked state. By default the vault does not lock by itself; the policy or the user can set a lock time.
- Unlock with Windows Hello, Touch ID or the phone's screen lock through a passkey (WebAuthn PRF). The server keeps only the sealed account key.
- Browser extensions for Chrome, Edge, Opera, Brave, Vivaldi and Firefox, downloadable from the console. They fill logins and one-time codes on the matching site only, save new logins and scan 2FA QR codes.
- Remote connections through the MaxZit Launcher (shared with WatchZit), downloadable from the console and paired with the browser once.
- Teams:
- shared vaults with rights, groups and time-limited access
- LDAP and SSO (OIDC, SAML)
- secret links, emergency access, per-item access log and four-eyes approval
- Accounts and administration:
- two-factor sign-in (TOTP, security keys, passkeys) and a recovery key
- vault policy and a hash-chained audit log
- 14 languages and a built-in guide
- Operation:
- installer with signature check, deb/rpm packages (amd64, arm64)
- appliance images (OVA, QCOW2, VHDX, ISO)
- signed self-update, encrypted backups with SFTP copy
Install
:::sh
curl -fsSL https://github.com/Max-Zit/passzit/releases/latest/download/install.sh | sudo sh
Or import a VM image from this release. See the README and the guide built into the console.
