An open-source, self-hosted PHP/MySQL password vault with AES-256-GCM encryption, folder-level access control, and compliance-grade audit trails for authorized teams.
| Tool | nilsteampassnet/TeamPass — self-hosted collaborative password manager with folder-level access control and AES-256-GCM encryption |
| Category | Password and secrets management (PHP/MySQL web application) |
| Primary Use | Centralizing team credentials in a self-hosted vault with roles, folders, SSO/LDAP integration, and audit evidence for authorized organizational use |
| Safe Use | Deploying on infrastructure you own or administer, for authorized credential governance, compliance reporting, and defensive reduction of password sprawl in chat threads and spreadsheets |
| Telemetry Note | Fully self-hosted: no vendor telemetry leaves your infrastructure. All access is recorded in the internal audit trail; defenders should monitor the vault's own logs, session events, and Network ACL violations |
TeamPass, hosted at nilsteampassnet/TeamPass, is one of the older and more battle-tested entries in the self-hosted password management space — the README states it has been built and maintained since 2009, which is a notable longevity signal for a secrets-handling application. At its core it is a PHP application backed by MySQL or MariaDB, requiring PHP 8.2+ and MySQL 5.7+ or MariaDB 10.7+. The design philosophy is blunt and visible in the project's framing: no account to create, no company holding your data, your secrets never leave your infrastructure. That positioning makes it a natural fit for security teams that are — rightly — uncomfortable placing their most sensitive credentials with a third-party SaaS provider, and it has accumulated roughly 1,873 stars on GitHub under a GPL-3.0 license.
The encryption model is the part a professional evaluator will scrutinize first, and the README describes it in genuinely respectable detail. Secrets are encrypted with AES-256-GCM — authenticated encryption, meaning tampering is detected rather than silently decrypted — using random nonces and per-secret salts under 256-bit object keys. The user's private key is derived from their password via PBKDF2-SHA256 at 600,000 iterations, which is a contemporary, non-embarrassing parameter choice. The README also documents per-user key distribution: every user holds their own RSA-wrapped copy of each object key, so removing an account actually revokes cryptographic access instead of merely hiding a UI element — a distinction that matters enormously when offboarding a departing admin.
Access control is organized around folders and roles rather than per-user permission sprawl. Folders support unlimited nesting and per-folder password complexity rules; roles grant access collectively; and rights — read, write, no-edit, no-delete — are resolved with a least-permissive-wins policy, which is the correct default for a security tool. Per-user overrides sit on top of roles for exceptions, and personal folders are cryptographically private: the README explicitly states that not even administrators can read them. For an authorized internal deployment, that combination gives you the standard separation between "team-shared break-glass credentials" and "individual secrets" without standing up two systems.
Governance and audit capabilities are where TeamPass differentiates itself from lighter homelab vaults. The feature set includes access recertification campaigns with immutable decisions, compliance reports and evidence export suitable for handing directly to an auditor, rotation tracking showing what was rotated, when, and by whom, and a "leaver risk" view that surfaces what a departing user could still know — a genuinely thoughtful feature, since anyone who has read a shared password in plaintext retains it regardless of revocation. Data classification adds ownership and sensitivity labels. For teams operating under formal frameworks, these map naturally onto the evidence-collection obligations of access reviews.
Identity integration covers the enterprise basics: local accounts, LDAP/AD with nested groups, and OAuth2 SSO. Multi-factor support spans TOTP (Google Authenticator), Duo Security, YubiKey, and AGSES. A network ACL restricts access by IP range, and session management offers timeouts, concurrent session limits, and Redis-backed storage. The topics list also mentions passkeys and password-rotation as first-class concerns. None of this is exotic, but the breadth suggests the project has absorbed requirements from real regulated deployments rather than chasing consumer feature checklists.
The security posture tooling deserves its own note because it approaches the problem from the defensive side. Users get a personal score for weak, reused, and breached credentials, with Have I Been Pwned checks performed — per the README — without sending your passwords, presumably via the standard k-anonymity range-query technique. Password renewal policies with expiry reminders and in-app "micro-learning" nudges round this out. It is a pragmatic acknowledgment that a vault full of terrible passwords is a liability concentration, not an improvement.
Automation support is solid for integration into an authorized workflow. A REST API is authenticated with JWT and documented against an OpenAPI 3.1 specification, with Bash and PowerShell client examples referenced — useful for pulling credentials into controlled CI pipelines or provisioning scripts. A browser extension handles autofill and capture, background tasks manage key distribution and maintenance, real-time collaboration uses WebSocket sync with edition locks, and scheduled encrypted database dumps cover backups. Migration paths exist both ways: import from Bitwarden, LastPass, 1Password, KeePassXC, or CSV; export to CSV, PDF, or a self-contained encrypted offline HTML vault. The no-lock-in claim is backed by the simple fact that it is your database on your server.
The project's attitude toward vulnerability disclosure is itself a security signal worth analyzing. The README's line — "a password manager that reports no vulnerabilities is not a password manager that has none" — reflects a mature engineering culture. Findings are triaged, fixed, and published as GitHub Security Advisories with CVE identifiers, private reporting is the requested channel, and a dedicated security hardening guide exists in the documentation. The repository also runs CodeQL analysis via GitHub Actions, visible in the CI badges, and publishes official Docker images on Docker Hub under teampass/teampass — deployment via docker pull teampass/teampass is the lowest-friction path for a lab evaluation.
From an operator's perspective, the deployment envelope is flexible: the README notes it runs on anything from a Raspberry Pi or a cheap VPS for individuals and homelabs up to regulated enterprise environments. That range is a real strength but also imposes responsibility — a self-hosted vault is only as secure as the host, the MySQL instance, and the TLS in front of it. Anyone standing up TeamPass in production should treat the security hardening guide, Network ACL restrictions, and MFA enforcement as baseline requirements rather than optional extras, and should monitor the application's own audit trail for anomalous access patterns.
Where does it fit relative to alternatives? Compared to SaaS password managers, TeamPass trades convenience for sovereignty: you own the keys, the database, and the incident response. Compared to full secrets-management platforms like HashiCorp Vault, it is more human-oriented — aimed at teams sharing credentials among people rather than machines fetching them at scale, though the REST API and browser extension blur that line somewhat. For a security team's internal credential store, a red-team's engagement-password vault, or an SMB trying to kill the shared spreadsheet, the combination of AES-256-GCM, least-permissive rights resolution, immutable access reviews, and sixteen years of maintenance history makes it a credible, inspectable choice.
nilsteampassnet/TeamPass.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.