30-minute setup 
Access depends on individuals
Ad account and CMS logins are stored in personal browsers and inboxes, outside agency control.
How Passwork works
A vault for each client, owned by the agency.
Password and access management for marketing agencies
Manage access to the accounts your revenue runs on
One place to manage who can access each client account. Access follows the project, and ownership stays with the agency
- 30-minute setup
- No credit card required
- On-premise EU deployment
- ISO/IEC 27001:2022 certified
Trusted by top teams:
The business risk. Client accounts generate your revenue, yet no one at your agency knows exactly who can access them
Staff turnover leaves access open
Account managers and freelancers move on, and their client logins keep working.
How Passwork works
Blocking a user ends every session at once.
Credentials are shared in chat
A password posted in Slack or email remains visible to everyone in the thread.
How Passwork works
Share one login through a link that expires.
Clients audit their supply chain
Under NIS2, regulated clients must secure their supply chain, and your agency is part of it.
How Passwork works
An activity log for every client login.
Why it matters. Unmanaged access puts agency revenue at risk
-
Ad account theft
1.86M
email detections of campaigns stealing Meta Business Manager and Google Ads accounts in the second half of 2025, a record.
Mimecast, July 2026
-
Agency staffing
55%
of GWA agencies surveyed in Germany had fewer permanent staff than a year earlier.
GWA Frühjahrsmonitor, March 2026 (92 agencies, weighted by revenue)
-
Leaks in chat tools
28%
of secret leak incidents start outside code, in tools like Slack and Jira.
GitGuardian, March 2026
-
Cost of a breach
€4.25M
average cost of a data breach at German companies in IBM's study.
IBM Cost of a Data Breach, July 2026
The solution. One system for client access, owned by the agency
Create a vault for each client and a folder for each project. Assign rights to each person or group, from read only to administrator.
Blocking a user ends all their sessions at once. The security dashboard then flags every password they could access that has not been changed since, so your team knows which client logins to rotate.
Send a single entry to a colleague, or share it with a freelancer or client through a link. Links can be single use or expire after an hour, a week or a month. Every opening is recorded.
The activity log shows who opened or changed each client login and when. Every password keeps its full change history, and events can be forwarded to your SIEM.
Getting started. Four steps to move your agency to Passwork
Passwork runs on your own server. Move clients over one at a time, at your own pace.
Deploy on your server
Your IT team installs Passwork on a Linux or Windows server. Offline installation is supported.
Import existing credentials
Import from spreadsheets or KeePass. Migration guides cover 1Password, LastPass, RoboForm and Bitwarden.
Structure by client
Create a vault for each client and a folder for each project.
Onboard your team
Invites can place each person directly in the right group. When a freelance project ends, deactivate the project group.
Customer reviews.
What customers say about Passwork
Joe H.
Solutions Architect, Events Services
"Offboarding staff is now easy."
"Ease of sharing, especially the one-time expiring links."
Capterra, 8 April 2025
Michael P.
CEO, Internet
"We don't lose any time when onboarding new employees or freelancers, which makes working with Passwork very effective."
Capterra, 21 May 2025
Lukas B.
IT administrator
"When someone leaves the team, we know exactly what needs to be rotated. That alone saves us hours and takes a lot of risk off the table."
G2, 25 April 2026
Verified user
Mid-market
"...offboarding an employee meant manually chasing down shared passwords. Passwork provided us with a single, auditable source of truth."
G2, 24 April 2026
Customer success story
How Kindernothilfe secured 300+ global employees
The results: Increasing operational efficiency for cross-border teams
Read full case study →
Features.
Features that fit agency operations
Shared 2FA codes
Store the 2FA setup key of a shared client account in the entry, and the team sees the current code.
API keys and tokens
Store API keys and tokens for AI tools and hosting in the same vault as the client's logins.
Browser extension and apps
Autofill in Chrome, Firefox, Edge and Safari. Desktop and mobile apps are also available.
Available for 
Client tags
Group entries by client or project with tags.
Mandatory 2FA
Require 2FA for each role. A passkey can serve as the second factor.
Password generator
Generate passwords for new client accounts, up to 100 characters long.
Advanced
Company sign-in and directory sync
Sign in through your SAML identity provider. With auto-deactivation on, people who are no longer in any mapped directory group are deactivated at the next sync.
Advanced
Delegated administration
Team leads manage only the people in their own department.
Security.
Answers for your clients' security reviews
Your own server
Passwork runs on your infrastructure. Offline installation is supported.
Encrypted on your server
Data is encrypted with AES-256 on the server. Client-side encryption is an option you choose at installation.
ISO/IEC 27001:2022
Passwork is certified, certificate CERT-001724.
Penetration test
Tested by HackerOne, results published in July 2025.
Source code audit
Each licence includes the option to audit the source code.
NIS2 and your clients
Clients in NIS2 scope must secure their supply chain (§ 30(2) No. 4 BSIG). The activity log gives you an access record to show them.
Passwork compared.
How Passwork compares on agency requirements
Six points that decide how an agency controls client access, side by side with four other password managers.
Full comparison
The feature column stays pinned. Swipe to see all five products.
| Features |
|---|
| Runs on your own server |
| Project folders inside each client vault, with rights on any folder |
| Agency admins locked into every new client vault |
| Expiring link for a freelancer or client |
| API keys for scripts and integrations in the same product |
| List price per user per month, billed annually |
 |  |  |  |  |
|---|---|---|---|---|
| Linux or Windows Server | Enterprise plan only | Cloud only | Vault in Keeper's cloud | Yes |
| Rights pass down the folder tree | Nested collections, each with its own rights | Rights per vault, no folders | Nested folder rights in invitation-only preview | Folder rights apply on create or move |
| Set per vault type (Advanced) | One organisation-wide admin setting | Admins by default, the vault creator can turn it off | Share Admin added to each folder by hand | Not available |
| Single use, or 1 hour to 1 month | Send link | Expiring link | One-Time Share | Not available |
| Included in Advanced | Secrets Manager, $6 to $12 extra per user | Included, through service accounts | Secrets Manager, paid add-on | Runs as a user seat |
| 3€ Standard 4,5€ Advanced | $6 Enterprise, the plan that self-hosts | $8.99 Business | $4 Business | €4.50 Pro, 10-user minimum |
- Meets the requirement
- Partly
- Not available
Based on each vendor's public documentation and list prices in September 2026, in the currency each vendor publishes. Features and prices change, so check the vendor's site for current terms. Bitwarden, 1Password, Keeper and Passbolt are trademarks of their owners.
Choose your plan
35% off for marketing agencies until 16 November
Compare Passwork plans
Pick a plan and the number of user seats to see your first-year price with the agency offer. Prices are per user per month, billed annually.
-
Standard
Essential features for small and medium businesses to support secure growth
1,95€ 3€per month /
per user
billed annually- Vaults and folders per client
- Access rights per person and group
- Activity log and security dashboard
-
Advanced Popular
Advanced capabilities for large-scale security and management needs
2,93€ 4,5€per month /
per user
billed annually- SAML SSO and LDAP group sync
- Delegated administration
- Offline access in desktop and mobile apps
Agency offer
First-year self-hosted licence for new customers
Advanced plan 25 user seats, billed annually
25 × 4,5€ × 12 months 1 350€
Agency offer −471€
Total, first year 879€
The offer applies to trial and offer requests sent by 16 November 2026.
Prices exclude VAT and are billed annually. Each licence includes one year of updates and technical support.
Want to test Passwork first? . Need a quote for a larger team?
Frequently asked questions
Yes. Give them rights to that client's vault only. For a single login, share a link that expires.
Block the user and all their sessions end at once. The security dashboard then flags the passwords left unchanged since their access was revoked, and you can filter by that person.
Yes. Add the account's 2FA setup key to the entry, and everyone with access sees the current code.
Import a CSV spreadsheet or a KeePass XML export. Step-by-step guides cover moves from 1Password, LastPass, RoboForm and Bitwarden.
On your own server. Passwork installs with Docker on Linux or with a PowerShell module on Windows Server, and supports offline installation.
Standard includes AD/LDAP sign-in. Advanced adds SAML SSO and LDAP group sync.
One month, free of charge. Ask us if your team needs more time.
New customers who send a trial or offer request by 16 November 2026. The offer covers the first-year self-hosted licence, Standard or Advanced.
Get 35% off Passwork until 16 November
Special pricing for marketing agencies on the first-year self-hosted licence, Standard or Advanced.
30-minute setup
30-minute setup No credit card required
On-premise EU deployment
ISO/IEC 27001:2022 certified
