intrvll
Open console

Software · Cloud or on-premises

Password Safe in our cloud or on your own servers

Password and credential management for IT teams, with zero-knowledge AES-256 encryption and built-in PAM with session recording. The cloud and on-premises versions have the same features.

Open the consoleRequest a demo
on-premises, flat
€349/mo
cloud, per month
from €14.99
zero-knowledge
AES-256
cloud uptime SLA
99.99%
01 / 03Pricing

Two plans, both with unlimited users

On-premises is a flat monthly price and runs on your own infrastructure. Cloud costs €14.99 a month plus €1.99 per user.

On-premises

€349

per month, flat rate, unlimited users

  • Updates and new features included
  • Self-hosted on your infrastructure

Authentication

Local Active DirectoryBasic user auth (no IdP)
Contact us to get started

Cloud SaaSRecommended

€14.99

per month, instance fee

+ €1.99 per user a month

  • Automatic updates and managed backups
  • 99.99% uptime SLA

Authentication

Microsoft Entra IDSAML 2.0 / OIDCBasic user auth (no IdP)
Get started

Everything included, on both plans

  • Teams and shared vaults
  • Zero-knowledge AES-256 encryption
  • PAM user management
  • Multiple vaults and granular permissions
  • Immutable audit trail
  • Browser extension (Chrome, Firefox, Edge)
  • REST API and CLI
  • GDPR compliant
  • SIEM export
  • Updates included
02 / 03Capabilities

What it does

Every feature is included in both plans.

Security core

Zero-knowledge encryption

Credentials are encrypted with AES-256 on your device, using PBKDF2 or Argon2id for key derivation, before they’re sent. They stay encrypted at rest, and the server never holds plaintext.
AES-256-GCMPBKDF2 / Argon2idClient-side onlyTLS 1.3 in transit

Privileged access

PAM and just-in-time access

Privileged access management with approval workflows, time-limited access, and session recording. Every elevated access is logged with a timestamp.
1 Request2 Approve3 Access4 Record

Collaboration

Teams and shared vaults

Vaults per team, department, or project, with read, write, manage, or share permissions per user and per vault.

Compliance

Immutable audit trail

Every credential read, edit, share, and deletion is logged with the time, user, and IP address. The log can’t be changed, and you can export it for GDPR requests.

Access

Browser extension and REST API

Auto-fill for Chrome, Firefox, and Edge. A REST API and CLI let you inject secrets into CI/CD pipelines, Kubernetes, and infrastructure-as-code.
$ vault secret get --id db-prod --format env

Authentication

Identity providers

You don’t need an external identity provider. On-premises connects to your local Active Directory, and cloud uses Entra ID over SAML 2.0 or OIDC. Basic auth works on both.
Entra IDLocal ADBasic auth
03 / 03Getting started

Set up in three steps

  1. 01

    Choose cloud or on-premises

    Cloud gives you a managed instance within minutes. On-premises runs on your own infrastructure. Both have the same features.

  2. 02

    Connect your identity provider

    Microsoft Entra ID in the cloud, local Active Directory on-premises, or basic user auth on either.

  3. 03

    Invite your team

    Create vaults, define PAM policies, set permissions per team and vault, and roll it out. Migration support is included.

Try Password Safe

A cloud instance is ready within minutes. On-premises installs include migration support. Contact us about air-gapped setups or specific compliance requirements.

Open the consoleRequest a demo