A Password Manager for Indie Teams and Startups

Enterprise password managers are built for 500-person IT departments. They have SAML, SCIM, on-prem connectors, and a quote-only price tag — none of which a 5-person startup needs. But the underlying problem is the same: shared credentials should be encrypted, access should be auditable, and revoking someone should be instant.

PassCryp solves the small-team problem without the enterprise tax. You create a shared vault, invite teammates by email, and pick read or write. The vault is encrypted with a per-vault key that's wrapped to each member's public key — when someone joins, their device unwraps the key locally; when someone leaves, the key rotates and old sessions go dark.

There's no admin console you have to learn. No SSO contract negotiation. No vendor onboarding call. The team workflow is the same as your personal workflow, just with vaults you share.

Each shared vault has a random 256-bit AES key generated client-side. For each member, PassCryp encrypts the vault key with the member's RSA public key (generated and stored locally when they signed up). The server stores N wrapped copies — one per member — and the vault key itself never exists in plaintext on our servers.

When a member opens a shared vault, their device fetches the wrapped key, decrypts it locally using their RSA private key (which never leaves their device), and then decrypts vault items as normal. Adding a member triggers a client-side wrap-and-upload; removing a member triggers a rotate-and-rewrap so the removed member's wrapped key becomes useless.

Audit logs record actions (item viewed, item updated, member added, member removed) but never contents. The log itself is append-only and signed.

Choose PassCryp if your team is under ~25 people, your secrets workflow is more about "don't email API keys" than about SOC2-mandated quarterly access reviews, and you want to onboard a teammate in 60 seconds instead of 60 minutes.

Choose an enterprise tool (1Password Business, Keeper Business) if you need SAML SSO, SCIM provisioning, on-prem secrets gateways, or a vendor contract for compliance. We're honest about where we fit — we'd rather lose a deal than oversell.