Platform
Solutions
Resources
Company
Platform
Solutions
Resources
Company
Use cases
Password and secrets management
Password and secrets management in the WWPass platform is handled by PassHub for Business — a vault for credentials, documents, and shared secrets secured with the WWPass Key and zero-trust architecture. No master password. Encryption keys derived from the WWPass Key, not a human-readable secret. Nothing readable on the server. Nothing accessible to administrators.
Use cases
Password and secrets management
Password and secrets management in the WWPass platform is handled by PassHub for Business — a vault for credentials, documents, and shared secrets secured with the WWPass Key and zero-trust architecture. No master password. Encryption keys derived from the WWPass Key, not a human-readable secret. Nothing readable on the server. Nothing accessible to administrators.
Use cases
Password and secrets management
Password and secrets management in the WWPass platform is handled by PassHub for Business — a vault for credentials, documents, and shared secrets secured with the WWPass Key and zero-trust architecture. No master password. Encryption keys derived from the WWPass Key, not a human-readable secret. Nothing readable on the server. Nothing accessible to administrators.
The shared secret problem
Most teams manage credentials through a combination of shared spreadsheets, browser-saved passwords, Slack messages, and password manager vaults protected by a single master password. Each of these creates the same problem: one point of compromise exposes everything.
A shared spreadsheet with service account credentials has no audit trail. A browser-saved password follows whoever uses that browser. A master password vault transfers risk from many weak passwords to one critical one — and when that master password is phished, guessed, or included in a breach, every secret inside is exposed simultaneously.
The problem is not that teams share credentials badly. It is that the architecture of most credential management tools requires a shared secret to exist somewhere.
What PassHub for Business secures
PassHub for Business stores every category of sensitive credential and secret a team manages:
Login credentials and service accounts
Bank account and payment card data
API keys and access tokens
SSL certificates
Software licence keys and serial numbers
Signed documents and sensitive files
Shared secrets of any type
Each item is encrypted on the user's device before it reaches the server. The server holds only encrypted data it cannot read.
Explore Passhub ∙ Zero-knowledge vault for credentials and sensitive data
No master password
Most password managers derive encryption keys from a master password. That master password is a human-readable secret — something to create, remember, transmit for account recovery, and protect from phishing. It is the single point of failure the rest of the vault depends on.
PassHub for Business derives encryption keys from the WWPass Key instead. The WWPass Key generates a master encryption key that never leaves the device. There is no master password to create, remember, phish, or reset. There is no recovery email that, if compromised, unlocks the vault. The encryption key exists only on the device and only in the form the WWPass Key generates.
Team access without sharing credentials
PassHub for Business organizes secrets into safes. Each safe has its own encryption key. Safes can be assigned to one or more groups, and users can belong to one or more groups — following the same role-based access control model used in Active Directory, Microsoft Entra ID, and Google Workspace.
Sharing a safe gives a team member access to the credentials inside it without those credentials ever being decrypted and handed over. When a team member leaves, their access is revoked by revoking their key. No shared password needs to change. No credential rotation required across every system they had access to.
Every access event is logged with detail on who accessed what and when, with additional detail on administrator actions. PassHub for Business connects to external SIEM systems including Microsoft Sentinel and CrowdStrike for centralised audit.
Administrators manage the system, not the secrets
In most credential management systems, an administrator with sufficient access can read what is stored. This creates insider threat risk and means that a compromised administrator account exposes the entire vault.
PassHub for Business enforces separation of duties at the architecture level. Administrators manage the system and handle support and backup. They have no access to unencrypted credentials, encryption keys, or the contents of any safe. This is not a permission setting that an administrator can modify. It is an architectural property of how the data is stored.
An accounting firm using PassHub for Business stores client credentials, signed documents, and access keys in the vault. Data is encrypted before it leaves the device. Administrators manage the system but cannot access documents or keys and cannot manage user access.
What changes for teams
No shared passwords. Each team member accesses credentials through their own WWPass Key. No credential is ever decrypted and handed to another person.
No master password to protect. The encryption key lives in the WWPass Key, not in a human-readable secret that can be phished, guessed, or reset by an attacker.
No credential exposure at offboarding. Revoking a departing team member's key revokes their access to every safe immediately. No credential rotation across connected systems required.
No administrator access to secrets. Separation of duties is enforced at the architecture level. A compromised administrator account yields nothing about what is stored.
Full audit trail. Every access event is logged. SIEM integration available for Microsoft Sentinel and CrowdStrike.
Frequently asked questions
Q: What is the difference between PassHub for Business and a standard password manager?
A: Most password managers derive encryption keys from a master password — a human-readable secret that creates a single point of failure. PassHub for Business derives encryption keys from the WWPass Key instead. There is no master password. Encryption happens on the device before anything reaches the server. Administrators cannot access what is stored. The code is open source and auditable.
Q: Can team members share access to credentials without revealing them?
A: Yes. Credentials are organized into safes. A safe can be shared with a group of users without the credential inside ever being decrypted and handed over. Each user accesses the safe through their own WWPass Key. The credential itself remains encrypted throughout.
Q: What happens when a team member with vault access leaves the organization?
A: Their WWPass Key is revoked, which immediately revokes their access to every safe they belonged to. No shared passwords need to change. No credentials need to be rotated across connected systems. Access ends when the key is revoked.
Q: Does PassHub for Business integrate with existing IAM and SIEM systems?
A: Yes. PassHub for Business connects to Active Directory, Microsoft Entra ID, and Google Workspace for user management. For audit, it integrates with Microsoft Sentinel and CrowdStrike SIEM.
Q: Can PassHub for Business be deployed on our own infrastructure?
A: Yes. It is available as a hosted service, self-hosted on your own servers, or deployed through the PassHub for Business listing on Microsoft Azure Marketplace. The code is open source and can be independently audited.
The shared secret problem
Most teams manage credentials through a combination of shared spreadsheets, browser-saved passwords, Slack messages, and password manager vaults protected by a single master password. Each of these creates the same problem: one point of compromise exposes everything.
A shared spreadsheet with service account credentials has no audit trail. A browser-saved password follows whoever uses that browser. A master password vault transfers risk from many weak passwords to one critical one — and when that master password is phished, guessed, or included in a breach, every secret inside is exposed simultaneously.
The problem is not that teams share credentials badly. It is that the architecture of most credential management tools requires a shared secret to exist somewhere.
What PassHub for Business secures
PassHub for Business stores every category of sensitive credential and secret a team manages:
Login credentials and service accounts
Bank account and payment card data
API keys and access tokens
SSL certificates
Software licence keys and serial numbers
Signed documents and sensitive files
Shared secrets of any type
Each item is encrypted on the user's device before it reaches the server. The server holds only encrypted data it cannot read.
Explore Passhub ∙ Zero-knowledge vault for credentials and sensitive data
No master password
Most password managers derive encryption keys from a master password. That master password is a human-readable secret — something to create, remember, transmit for account recovery, and protect from phishing. It is the single point of failure the rest of the vault depends on.
PassHub for Business derives encryption keys from the WWPass Key instead. The WWPass Key generates a master encryption key that never leaves the device. There is no master password to create, remember, phish, or reset. There is no recovery email that, if compromised, unlocks the vault. The encryption key exists only on the device and only in the form the WWPass Key generates.
Team access without sharing credentials
PassHub for Business organizes secrets into safes. Each safe has its own encryption key. Safes can be assigned to one or more groups, and users can belong to one or more groups — following the same role-based access control model used in Active Directory, Microsoft Entra ID, and Google Workspace.
Sharing a safe gives a team member access to the credentials inside it without those credentials ever being decrypted and handed over. When a team member leaves, their access is revoked by revoking their key. No shared password needs to change. No credential rotation required across every system they had access to.
Every access event is logged with detail on who accessed what and when, with additional detail on administrator actions. PassHub for Business connects to external SIEM systems including Microsoft Sentinel and CrowdStrike for centralised audit.
Administrators manage the system, not the secrets
In most credential management systems, an administrator with sufficient access can read what is stored. This creates insider threat risk and means that a compromised administrator account exposes the entire vault.
PassHub for Business enforces separation of duties at the architecture level. Administrators manage the system and handle support and backup. They have no access to unencrypted credentials, encryption keys, or the contents of any safe. This is not a permission setting that an administrator can modify. It is an architectural property of how the data is stored.
An accounting firm using PassHub for Business stores client credentials, signed documents, and access keys in the vault. Data is encrypted before it leaves the device. Administrators manage the system but cannot access documents or keys and cannot manage user access.
What changes for teams
No shared passwords. Each team member accesses credentials through their own WWPass Key. No credential is ever decrypted and handed to another person.
No master password to protect. The encryption key lives in the WWPass Key, not in a human-readable secret that can be phished, guessed, or reset by an attacker.
No credential exposure at offboarding. Revoking a departing team member's key revokes their access to every safe immediately. No credential rotation across connected systems required.
No administrator access to secrets. Separation of duties is enforced at the architecture level. A compromised administrator account yields nothing about what is stored.
Full audit trail. Every access event is logged. SIEM integration available for Microsoft Sentinel and CrowdStrike.
Frequently asked questions
Q: What is the difference between PassHub for Business and a standard password manager?
A: Most password managers derive encryption keys from a master password — a human-readable secret that creates a single point of failure. PassHub for Business derives encryption keys from the WWPass Key instead. There is no master password. Encryption happens on the device before anything reaches the server. Administrators cannot access what is stored. The code is open source and auditable.
Q: Can team members share access to credentials without revealing them?
A: Yes. Credentials are organized into safes. A safe can be shared with a group of users without the credential inside ever being decrypted and handed over. Each user accesses the safe through their own WWPass Key. The credential itself remains encrypted throughout.
Q: What happens when a team member with vault access leaves the organization?
A: Their WWPass Key is revoked, which immediately revokes their access to every safe they belonged to. No shared passwords need to change. No credentials need to be rotated across connected systems. Access ends when the key is revoked.
Q: Does PassHub for Business integrate with existing IAM and SIEM systems?
A: Yes. PassHub for Business connects to Active Directory, Microsoft Entra ID, and Google Workspace for user management. For audit, it integrates with Microsoft Sentinel and CrowdStrike SIEM.
Q: Can PassHub for Business be deployed on our own infrastructure?
A: Yes. It is available as a hosted service, self-hosted on your own servers, or deployed through the PassHub for Business listing on Microsoft Azure Marketplace. The code is open source and can be independently audited.
The shared secret problem
Most teams manage credentials through a combination of shared spreadsheets, browser-saved passwords, Slack messages, and password manager vaults protected by a single master password. Each of these creates the same problem: one point of compromise exposes everything.
A shared spreadsheet with service account credentials has no audit trail. A browser-saved password follows whoever uses that browser. A master password vault transfers risk from many weak passwords to one critical one — and when that master password is phished, guessed, or included in a breach, every secret inside is exposed simultaneously.
The problem is not that teams share credentials badly. It is that the architecture of most credential management tools requires a shared secret to exist somewhere.
What PassHub for Business secures
PassHub for Business stores every category of sensitive credential and secret a team manages:
Login credentials and service accounts
Bank account and payment card data
API keys and access tokens
SSL certificates
Software licence keys and serial numbers
Signed documents and sensitive files
Shared secrets of any type
Each item is encrypted on the user's device before it reaches the server. The server holds only encrypted data it cannot read.
Explore Passhub ∙ Zero-knowledge vault for credentials and sensitive data
No master password
Most password managers derive encryption keys from a master password. That master password is a human-readable secret — something to create, remember, transmit for account recovery, and protect from phishing. It is the single point of failure the rest of the vault depends on.
PassHub for Business derives encryption keys from the WWPass Key instead. The WWPass Key generates a master encryption key that never leaves the device. There is no master password to create, remember, phish, or reset. There is no recovery email that, if compromised, unlocks the vault. The encryption key exists only on the device and only in the form the WWPass Key generates.
Team access without sharing credentials
PassHub for Business organizes secrets into safes. Each safe has its own encryption key. Safes can be assigned to one or more groups, and users can belong to one or more groups — following the same role-based access control model used in Active Directory, Microsoft Entra ID, and Google Workspace.
Sharing a safe gives a team member access to the credentials inside it without those credentials ever being decrypted and handed over. When a team member leaves, their access is revoked by revoking their key. No shared password needs to change. No credential rotation required across every system they had access to.
Every access event is logged with detail on who accessed what and when, with additional detail on administrator actions. PassHub for Business connects to external SIEM systems including Microsoft Sentinel and CrowdStrike for centralised audit.
Administrators manage the system, not the secrets
In most credential management systems, an administrator with sufficient access can read what is stored. This creates insider threat risk and means that a compromised administrator account exposes the entire vault.
PassHub for Business enforces separation of duties at the architecture level. Administrators manage the system and handle support and backup. They have no access to unencrypted credentials, encryption keys, or the contents of any safe. This is not a permission setting that an administrator can modify. It is an architectural property of how the data is stored.
An accounting firm using PassHub for Business stores client credentials, signed documents, and access keys in the vault. Data is encrypted before it leaves the device. Administrators manage the system but cannot access documents or keys and cannot manage user access.
What changes for teams
No shared passwords. Each team member accesses credentials through their own WWPass Key. No credential is ever decrypted and handed to another person.
No master password to protect. The encryption key lives in the WWPass Key, not in a human-readable secret that can be phished, guessed, or reset by an attacker.
No credential exposure at offboarding. Revoking a departing team member's key revokes their access to every safe immediately. No credential rotation across connected systems required.
No administrator access to secrets. Separation of duties is enforced at the architecture level. A compromised administrator account yields nothing about what is stored.
Full audit trail. Every access event is logged. SIEM integration available for Microsoft Sentinel and CrowdStrike.
Frequently asked questions
Q: What is the difference between PassHub for Business and a standard password manager?
A: Most password managers derive encryption keys from a master password — a human-readable secret that creates a single point of failure. PassHub for Business derives encryption keys from the WWPass Key instead. There is no master password. Encryption happens on the device before anything reaches the server. Administrators cannot access what is stored. The code is open source and auditable.
Q: Can team members share access to credentials without revealing them?
A: Yes. Credentials are organized into safes. A safe can be shared with a group of users without the credential inside ever being decrypted and handed over. Each user accesses the safe through their own WWPass Key. The credential itself remains encrypted throughout.
Q: What happens when a team member with vault access leaves the organization?
A: Their WWPass Key is revoked, which immediately revokes their access to every safe they belonged to. No shared passwords need to change. No credentials need to be rotated across connected systems. Access ends when the key is revoked.
Q: Does PassHub for Business integrate with existing IAM and SIEM systems?
A: Yes. PassHub for Business connects to Active Directory, Microsoft Entra ID, and Google Workspace for user management. For audit, it integrates with Microsoft Sentinel and CrowdStrike SIEM.
Q: Can PassHub for Business be deployed on our own infrastructure?
A: Yes. It is available as a hosted service, self-hosted on your own servers, or deployed through the PassHub for Business listing on Microsoft Azure Marketplace. The code is open source and can be independently audited.
Get WWPass
Download the WWPass Key app and test authentication without a username or password.
Get WWPass
Download the WWPass Key app and test authentication without a username or password.
