La nueva versión introduce autenticación biométrica y por passkey, la opción de añadir múltiples URL para una sola contraseña, verificación de direcciones de correo electrónico para usuarios, autenticación basada en correo electrónico y numerosas otras mejoras y correcciones.
Autenticación biométrica y passkeys
Se ha añadido soporte para autenticación biométrica, passkeys y llaves de seguridad basadas en el estándar WebAuthn. Ahora es posible iniciar sesión en Passwork utilizando huella dactilar, Face ID, código PIN o una llave de seguridad de hardware (YubiKey y dispositivos similares).
En la página de configuración de Autenticación, puede añadir nuevos métodos de inicio de sesión, gestionar los existentes, cambiar su contraseña o habilitar la autenticación sin contraseña mediante biometría o llaves de seguridad de hardware.
La página de configuración de autenticación se bloquea automáticamente después de 5 minutos de inactividad — haga clic en el icono de candado en la esquina superior derecha para desbloquearla.
La nueva configuración de rol Usar passkey en lugar de contraseña permite a los usuarios autenticarse con una passkey en lugar de su contraseña local o de dominio.
Puede restablecer una passkey para un usuario individual en su página en la sección Gestión de usuarios a través de la ventana modal Autenticación.
Obtenga más información sobre los métodos de autenticación en nuestro manual de usuario.
Múltiples URL por entrada
Ahora es posible añadir múltiples URL a una sola entrada. Esto es útil cuando una cuenta se utiliza para acceder a diferentes direcciones: entornos de prueba y producción, versiones regionales de un sitio web o servicios relacionados de la empresa. La extensión del navegador sugerirá automáticamente completar las credenciales en cualquiera de las URL especificadas.
Verificación de correo electrónico
Passwork ahora soporta la verificación obligatoria de correo electrónico para usuarios. Cuando un usuario añade o cambia su dirección de correo electrónico, Passwork envía un correo de verificación con un enlace de confirmación.
Las notificaciones por correo electrónico solo se enviarán a direcciones verificadas. Las excepciones incluyen: correos de prueba, correos de verificación, correos de registro e invitaciones.
Puede habilitar la confirmación obligatoria de correo electrónico en Configuración del sistema → Registro → Confirmación obligatoria de correo electrónico.
Sin verificación de correo electrónico, pueden aparecer direcciones inválidas en el sistema. Esto puede crear problemas: las notificaciones no llegan a los usuarios, el restablecimiento de contraseña falla y surgen riesgos de seguridad. La confirmación de correo electrónico asegura que los mensajes se entreguen solo a destinatarios legítimos.
Autenticación basada en correo electrónico
Se ha añadido la posibilidad de iniciar sesión en Passwork utilizando una dirección de correo electrónico verificada en lugar de un nombre de usuario para simplificar la autenticación y reducir los errores de inicio de sesión. Después de habilitar esta configuración, el inicio de sesión basado en nombre de usuario permanece disponible, y todas las direcciones de correo electrónico se verificarán para asegurar su unicidad en el sistema.
Puede habilitar la autenticación basada en correo electrónico en Passwork en Configuración del sistema → Registro → Iniciar sesión con correo electrónico.
Mejoras
Se mejoró el filtro de usuarios en el Registro de actividad: la búsqueda ahora considera no solo al iniciador de la acción sino también a los usuarios vinculados.
Se corrigió un problema donde el filtro de carpetas en el Panel de seguridad y el Registro de actividad podría no incluir datos de subcarpetas anidadas al seleccionar una carpeta principal.
Se añadió el bloqueo automático de la página de configuración de autenticación después de 5 minutos de inactividad.
Se añadió una opción para establecer un color para cada acceso directo individualmente sin cambiar el color de la contraseña inicial.
Se realizaron mejoras en la interfaz de usuario y la localización.
Corrección de errores
Se corrigió un problema donde la opción Editar en Gestión de usuarios no se activaba cuando la opción «Editar correo electrónico del usuario» estaba habilitada en la configuración de roles.
Se corrigió la visualización incorrecta del banner que solicita añadir una cuenta de servicio en la página de edición del servidor LDAP después de recargar la página.
Se corrigió un problema donde el botón Actualizar en la ventana modal de edición de usuario podía permanecer inactivo cuando había cambios sin guardar.
Se corrigió un problema en el asistente de configuración donde un mensaje incorrecto «La base de datos ya existe» podía mostrarse en la página de conexión de base de datos.
Se corrigió un problema donde después de guardar cambios en la ventana modal de Acceso a bóveda o Acceso a carpeta, se mostraba un mensaje incorrecto «¿Descartar cambios?» al intentar cerrar la ventana.
Se corrigió un problema donde las notificaciones sobre intentos fallidos de ingreso de código PIN en la extensión del navegador podrían no enviarse.
Puede encontrar toda la información sobre las actualizaciones de Passwork en nuestras notas de versión
En la nueva versión, hemos añadido soporte para passkeys y biometría, un mecanismo de verificación de direcciones de correo electrónico para usuarios, la opción de especificar múltiples URL para una sola contraseña, personalización independiente del color de accesos directos, así como numerosas…
The new version introduces biometric and passkey authentication, the option to add multiple URLs for a single password, email address verification for users, email-based authentication, and numerous other improvements and fixes.
Biometric authentication and passkeys
We've added support for biometric authentication, passkeys, and security keys based on the WebAuthn standard. You can now sign in to Passwork using your fingerprint, Face ID, PIN code, or a hardware security key (YubiKey and similar devices).
On the Authentication settings page, you can add new sign-in methods, manage existing ones, change your password, or enable passwordless authentication through biometrics or hardware security keys.
The authentication settings page automatically locks after 5 minutes of inactivity — click the lock icon in the top-right corner to unlock it.
The new role setting Use passkey instead of password allows users to authenticate with a passkey instead of their local or domain password.
You can reset a passkey for an individual user on their page in the User management section through the Authentication modal window.
Learn more about authentication methods in our user manual.
Multiple URLs per entry
You can now add multiple URLs to a single entry. This is useful when one account is used to access different addresses: test and production environments, regional versions of a website, or related company services. The browser extension will automatically suggest filling in credentials on any of the specified URLs.
Email verification
Passwork now supports mandatory email verification for users. When a user adds or changes their email address, Passwork sends a verification email with a confirmation link.
Email notifications will only be sent to verified addresses. Exceptions include: test emails, verification emails, registration emails, and invites.
You can enable mandatory email confirmation in System settings → Registration → Mandatory email confirmation.
Without email verification, invalid addresses can appear in the system. This can create problems: notifications don't reach users, password reset fails, and security risks emerge. Email confirmation ensures that messages are delivered only to legitimate recipients.
Email-based authentication
We've added the ability to sign in to Passwork using a verified email address instead of a login to simplify authentication and reduce login errors. After enabling this setting, username-based sign-in remains available, and all email addresses will be checked for uniqueness in the system.
You can enable email-based authentication in Passwork in System settings → Registration→ Sign in with email.
Improvements
Improved the user filter in the Activity log: search now considers not only the action initiator but also linked users
Fixed an issue where the folder filter in Security dashboard and Activity log might not include data from nested subfolders when selecting a parent folder
Added automatic locking of the authentication settings page after 5 minutes of inactivity
Added an option to set a color for each shortcut individually without changing the color of the initial password
Fixed an issue where the Edit option in User management was not activated when the "Edit user email" option was enabled in role settings
Fixed incorrect display of the banner prompting to add a service account on the LDAP server edit page after reloading the page
Fixed an issue where the Update button in the user edit modal could remain inactive when there were unsaved changes
Fixed an issue in the setup wizard where an incorrect "Database already exists" message could be displayed on the database connection page
Fixed an issue where after saving changes in the Vault access or Folder access modal, an incorrect "Discard changes?" message was displayed when attempting to close the window
Fixed an issue where notifications about failed PIN code entry attempts in the browser extension might not be sent
You can find all information about Passwork updates in our release notes
In the new version, we've added support for passkeys and biometrics, an email address verification mechanism for users, the option to specify multiple URLs for a single password, independent shortcut color customization, as well as numerous improvements and fixes.
Die Stadt Melle, eine Gemeinde in Niedersachsen mit mehr als 48.000 Einwohnern, ist bekannt für ihren modernen Ansatz in der Stadtverwaltung und bei Bürgerservices. Die Kommunalverwaltung übernimmt ein breites Spektrum an Aufgaben: Stadtentwicklung, Bildung, Sozialfürsorge, Umweltschutz, Kulturinitiativen, kommunale Infrastruktur und wirtschaftliche Unterstützung für die Region.
In den letzten Jahren hat Melle stark in die digitale Transformation investiert, Online-Bürgerservices eingeführt, interne Verwaltungsabläufe modernisiert und die technologische Grundlage verbessert, die den täglichen kommunalen Betrieb unterstützt. Die Verwaltung ist bekannt für ihr Engagement für Transparenz, Effizienz und Servicequalität — und erhält regelmäßig positive Anerkennung von den Bürgern für ihre gut organisierten städtischen Dienste und ihre proaktive, lösungsorientierte Verwaltungsführung.
Als städtische Institution verpflichtet sich die Verwaltung, höchste Standards beim Datenschutz und bei der betrieblichen Integrität einzuhalten. Das IT-Team der Stadt ist kontinuierlich bestrebt, moderne Technologien zu implementieren, die Arbeitsabläufe optimieren, die Sicherheit erhöhen und die Mitarbeiter bei ihren täglichen Aufgaben unterstützen. Dieses Engagement führte dazu, dass der bisherige Ansatz im Passwortmanagement neu bewertet wurde — mit dem Ziel, eine Lösung zu finden, die sowohl die Sicherheitsanforderungen erfüllt als auch benutzerfreundlich für die Mitarbeiter ist.
Unternehmen: Stadt Melle Standort: Niedersachsen, Deutschland Branche: Stadtverwaltung Unternehmensgröße: 450+ Mitarbeiter
Herausforderung: Einheitliches Passwortmanagement ohne Sicherheitsrisiken
Die Stadtverwaltung Melle erkannte die Notwendigkeit, die Zugangsdatensicherheit in den Arbeitsabläufen der Mitarbeiter zu verbessern. Verschiedene Abteilungen nutzten unterschiedliche Passwortmanagement-Lösungen, wobei die meisten den in Microsoft Edge integrierten Passwortmanager verwendeten. Dies führte zu isolierten Systemen mit eingeschränkter zentraler Übersicht, keiner Transparenz über Benutzeraktionen und uneinheitlichen Sicherheitsstandards in der gesamten Organisation.
Über die Sicherheit hinaus wollte das IT-Team das Passwortmanagement für die Mitarbeiter vereinfachen. Die Stadtverwaltung beschäftigt Menschen mit unterschiedlichem technischen Kenntnisstand, sodass Benutzerfreundlichkeit ebenso wichtig war wie Schutz.
„Das war uns besonders wichtig, damit wir kein zusätzliches Passwort haben, keine weitere Hürde für die Leute. Also wirklich nur ihr Windows-Passwort und dann am Ende des Tages die PIN für die Browser-Erweiterung." — Andre Kahlen, Systemadministrator
Das bedeutete, eine Lösung mit LDAP-Unterstützung zu finden — die es Benutzern ermöglicht, sich mit ihren bestehenden Windows-Zugangsdaten zu authentifizieren und eine zusätzliche Hürde bei der Einführung zu eliminieren. Dies führte dazu, dass das IT-Team die strategische Entscheidung traf, eine zentral verwaltete, unternehmenstaugliche Passwortmanagement-Lösung zu evaluieren und einzuführen.
Das Hauptziel war es, eine Plattform zu finden, die drei Kernanforderungen vereint:
Sicherheit: Hohe Sicherheit, die den strengen Datenschutzbestimmungen und internen Sicherheitsrichtlinien entspricht.
Benutzerfreundlichkeit: Außergewöhnliche Benutzerfreundlichkeit mit nahtloser Integration in die bestehende IT-Infrastruktur.
Kontrolle: Einfache, zentralisierte Administration, die Daten zugänglich hält und gleichzeitig schnellen technischen Support bietet.
Die Stadt Melle benötigte einen Dienst, der die Arbeitsabläufe aller Abteilungen vereinheitlichen, transparentes Zugriffsmanagement etablieren und sichere Passwortspeicherung gewährleisten konnte.
Um einen Passwortmanager auszuwählen, führte das IT-Team eine gründliche Analyse der auf dem Markt verfügbaren Lösungen durch. Nach sorgfältiger Abwägung entschied man sich für Passwork aufgrund seiner Sicherheitsfunktionen, granularen Kontrolle und benutzerfreundlichen Oberfläche — all dies entsprach den Kriterien genau.
Passworks Fähigkeit, zentrale Kontrolle zu bieten und gleichzeitig einen sicheren Bereich für Benutzer bereitzustellen, war für das IT-Team von Vorteil. Die Tresor-Struktur wurde ebenfalls als entscheidender Faktor betrachtet.
„Wir wollen die Kontrolle behalten, da wir viele Personen, besonders außerhalb der IT, mit Passwörtern arbeiten lassen. Einer der Vorteile von Passwork ist die zentralisierte Verwaltung."
Dieses Maß an Kontrolle war für die Kommune essenziell, da Administratoren eine große Menge sensibler Daten verwalten und Schutz benötigen, der unbefugten Zugriff auf vertrauliche Informationen effektiv verhindert.
Das Team testete erfolgreich alle deklarierten Funktionen und analysierte die Sicherheit auf Datenbankebene. Die Entscheidung basierte auf einer intensiven drei- bis viermonatigen Testphase mit etwa acht Mitgliedern der IT-Abteilung. Der gesamte Passwork-Implementierungsprozess, von der ersten Auswahl bis zur endgültigen Implementierung, dauerte über ein Jahr.
Die LDAP-Integration war essenziell, um Benutzerreibungen zu minimieren. Nach dem Testen implementierte die Stadtverwaltung Passwork in ihrer Infrastruktur mit folgender Konfiguration:
LDAP-Integration für zentralisiertes Benutzermanagement basierend auf Active Directory
Die Self-hosted-Lösung mit einer zusätzlichen Instanz für Mitarbeiter mit erhöhten Sicherheitsanforderungen in einem isolierten Netzwerksegment
Snapshot-basierte und klassische Backups, um sicherzustellen, dass Daten im Falle eines Vorfalls schnell wiederhergestellt werden können
„Wir haben die LDAP-Integration eingerichtet, um Benutzerkonten und Berechtigungen zentral zu verwalten, was sehr wichtig war. Wir haben uns entschieden, die Lösungen in mehrere Instanzen aufzuteilen. Der Zugriff ist auf diese Weise stark eingeschränkt."
Nach der erfolgreichen Implementierung musste das IT-Team die Arbeit der Mitarbeiter im neuen System strukturieren.
Organisation der Datenarbeit in Passwork
Das Ziel war es, ein ausgewogenes und flexibles System aufzubauen, das Kontrolle mit der Freiheit eines persönlichen Informationsbereichs für Mitarbeiter kombiniert. Das IT-Team etablierte eine klare Governance-Struktur:
Zentralisierte Administration — IT-Admins erhielten automatisch Zugriff auf alle Tresore, um die Kontrolle zu behalten
Personalisierte Schulungen zu sicheren Passwort-Export- und Import-Verfahren, um eine sichere Datenmigration zu gewährleisten
Onboarding-Sitzungen für jeden Benutzer während der Einrichtung, um Vertrauen aufzubauen und eine reibungslose Einführung sicherzustellen
Klare Richtlinien darüber, welche Informationen in gemeinsame Organisations-Tresore und welche in persönliche Tresore gehören
Mit Passwork erhielten Benutzer die Flexibilität, Tresore basierend auf ihren Arbeitsablauf-Anforderungen zu erstellen und zu organisieren.
Benutzer-Onboarding
Während des Rollouts stellte das IT-Team fest, dass zentralisierte Schulungssitzungen ineffektiv waren — viele Mitarbeiter fanden es schwierig, alle Informationen auf einmal aufzunehmen. Stattdessen wurde eine neue Methode gewählt: ein personalisierter Ansatz, der Benutzer ermutigen sollte, das Produkt zu akzeptieren, starke, generierte Passwörter zu verwenden, Zugangsdaten sicher zu teilen und Passwork effektiv zu nutzen.
„Die Passwork-Akzeptanz ist sehr gut: Mitarbeiter nehmen neue Funktionen leicht an. Es gibt eine persönliche Einweisung für jeden Benutzer, den wir einrichten. Dies umfasst auch Sicherheitsanforderungen und leitet an, wie das Tool effektiv genutzt werden kann. Mitarbeiter organisieren bereits ihren Bereich nach ihrer Struktur und denken darüber nach, wie sie Tresore gestalten können."
Mitarbeiter haben jederzeit Zugriff auf Benutzeranleitungen, und die IT-Abteilung bietet kontinuierliche Unterstützung, um aufkommende Fragen zu beantworten.
Ergebnis: Sicherheit und Effizienz in Arbeitsabläufen
Nach mehr als einem Jahr im Einsatz ist die Stadt Melle weiterhin sehr zufrieden mit Passwork. Die Lösung wird heute aktiv von Büromitarbeitern genutzt. Folgende Punkte wurden als besonders positiv hervorgehoben.
Einheitlicher sicherer Bereich für Datenspeicherung
Die Kommune hat Browser-basierte Lösungen aufgegeben: Alle Passwörter werden nun in einem sicheren System mit mehrstufiger Verschlüsselung gespeichert. Der Zugriff darauf ist streng kontrolliert und protokolliert — dies hilft, Datenlecks zu verhindern und ermöglicht bei Bedarf die Untersuchung von Vorfällen.
Positive Benutzerakzeptanz
Viele Mitarbeiter haben das Tool angenommen und denken proaktiv darüber nach, wie sie Organisations-Tresore strukturieren können.
Zuverlässiger Kundensupport
Das Passwork-Supportteam spielte eine wichtige Rolle bei der erfolgreichen Implementierung und dem Upgrade von Version 6 auf das kürzlich veröffentlichte Passwork 7.
„Der Kundensupport war bisher mit seinen schnellen Antworten ausgezeichnet. Ich habe immer Antworten auf meine Fragen, immer mit den richtigen Skripten oder der richtigen Syntax, die ich eingeben musste, alles bereits vorbereitet. Perfekt."
Die Stadt Melle plant, Passwork weiter auszurollen, bis alle Benutzer erfolgreich eingearbeitet sind. Das IT-Team hat begonnen, systematisch Feature-Anfragen zu sammeln, um das System an die spezifischen Anforderungen der IT-Infrastruktur der Stadtverwaltung anzupassen und sicherzustellen, dass es den betrieblichen Anforderungen entspricht.
Fazit
Passwork hat die interne Sicherheit der Stadt Melle verbessert, indem ein zuverlässiges System für das Passwortmanagement geschaffen wurde. Durch sorgfältige Evaluation und eine sicherheitsorientierte Implementierungsstrategie verlief die Einführung reibungslos. Ein maßgeschneiderter Onboarding-Ansatz führte zu hoher Benutzerakzeptanz, während die Zuverlässigkeit der Plattform und der reaktionsschnelle technische Support ihre Position als unverzichtbares Werkzeug im täglichen Verwaltungsbetrieb festigten.
Machen Sie auch den ersten Schritt! Starten Sie Ihre kostenlose Passwork-Testversion und erleben Sie, wie einfach sicheres Passwortmanagement sein kann.
La ciudad de Melle, un municipio en Baja Sajonia con más de 48.000 residentes, es reconocida por su enfoque moderno en la administración municipal y los servicios al ciudadano. El gobierno local gestiona una amplia gama de responsabilidades: desarrollo urbano, educación, atención social, protección medioambiental, iniciativas culturales, infraestructura municipal y apoyo económico a la región.
En los últimos años, Melle ha invertido considerablemente en la transformación digital, introduciendo servicios en línea para los ciudadanos, modernizando los flujos de trabajo administrativos internos y mejorando la base tecnológica que respalda las operaciones municipales diarias. La administración es conocida por su compromiso con la transparencia, la eficiencia y la calidad del servicio — recibiendo regularmente reconocimiento positivo de los residentes por sus servicios municipales bien organizados y su gobernanza proactiva y orientada a soluciones.
Como institución municipal, la administración está comprometida a mantener los más altos estándares de protección de datos e integridad operativa. El equipo de TI de la ciudad busca continuamente implementar tecnologías modernas que optimicen los flujos de trabajo, mejoren la seguridad y apoyen a sus empleados en sus tareas diarias. Este compromiso los llevó a reevaluar su enfoque de gestión de contraseñas, buscando una solución que cumpliera con sus requisitos de seguridad y que a la vez fuera fácil de usar para los empleados.
Empresa: Stadt Melle Ubicación: Baja Sajonia, Alemania Sector: Administración municipal Tamaño de la empresa: Más de 450 empleados
Desafío: Gestión unificada de contraseñas sin riesgos de seguridad
La administración municipal de Melle reconoció la necesidad de mejorar la seguridad de las credenciales en los flujos de trabajo de los empleados. Los diferentes departamentos dependían de diversas soluciones de gestión de contraseñas, y la mayoría utilizaba la integrada en Microsoft Edge. Esto resultó en sistemas aislados con supervisión central limitada, sin visibilidad de las acciones de los usuarios y estándares de seguridad inconsistentes en toda la organización.
Más allá de la seguridad, el equipo de TI quería simplificar la gestión de contraseñas para los empleados. La administración municipal emplea a personas con diferentes niveles de competencia técnica, por lo que la facilidad de uso era tan importante como la protección.
«Eso era especialmente importante para nosotros, para no tener una contraseña adicional, otra barrera para las personas. Realmente solo su contraseña de Windows y luego el PIN para la extensión del navegador al final del día.» — Andre Kahlen, administrador de sistemas
Esto significaba encontrar una solución con soporte LDAP — que permitiera a los usuarios autenticarse con sus credenciales de Windows existentes y eliminara una barrera adicional para la adopción. Esto llevó al equipo de TI a tomar la decisión estratégica de evaluar e introducir una solución de gestión de contraseñas empresarial y gestionada de forma centralizada.
El objetivo principal era encontrar una plataforma que combinara tres requisitos fundamentales:
Seguridad: alta seguridad que se alinee con las estrictas regulaciones de protección de datos y las políticas de seguridad internas.
Usabilidad: facilidad de uso excepcional con integración perfecta en la infraestructura de TI existente.
Control: administración centralizada y sencilla que mantenga los datos accesibles mientras proporciona soporte técnico rápido.
La ciudad de Melle requería un servicio que pudiera unificar los flujos de trabajo en todos los departamentos, establecer una gestión de acceso transparente y garantizar el almacenamiento seguro de contraseñas.
Solución: Construir una infraestructura resiliente
Para seleccionar un gestor de contraseñas, el equipo de TI realizó un análisis exhaustivo de las soluciones disponibles en el mercado. Tras una cuidadosa consideración, eligieron Passwork por sus funciones de seguridad, control granular e interfaz fácil de usar — todo lo cual coincidía estrechamente con sus criterios.
La capacidad de Passwork para proporcionar control centralizado mientras ofrece un espacio seguro para los usuarios fue beneficiosa para el equipo de TI. La estructura de bóvedas también se consideró un factor decisivo.
«Queremos mantener el control, ya que asignamos a muchas personas, especialmente aquellas fuera de TI, para que gestionen contraseñas. Una de las ventajas de Passwork es la gestión centralizada.»
Este nivel de control era esencial para el municipio, ya que los administradores manejan una gran cantidad de datos sensibles y requieren protección que prevenga eficazmente el acceso no autorizado a información confidencial.
El equipo probó con éxito todas las funciones declaradas y analizó la seguridad a nivel de base de datos. La decisión se basó en una fase de pruebas intensiva de tres a cuatro meses que involucró a unos ocho miembros del departamento de TI. Todo el proceso de implementación de Passwork, desde la selección inicial hasta la implementación final, tomó más de un año.
La integración LDAP fue esencial para minimizar la fricción del usuario. Después de las pruebas, la administración municipal desplegó Passwork dentro de su infraestructura con la siguiente configuración:
Integración LDAP para gestión centralizada de usuarios basada en Active Directory
La solución autoalojada con una instancia adicional para empleados con requisitos de seguridad elevados en un segmento de red aislado
Copias de seguridad basadas en snapshots y clásicas para garantizar que los datos puedan restaurarse rápidamente en caso de incidente
«Configuramos la integración LDAP para gestionar de forma centralizada las cuentas de usuario y los permisos, lo cual era muy importante. Decidimos dividir las soluciones en varias instancias. El acceso está muy restringido de esta manera.»
Tras la implementación exitosa, el equipo de TI necesitaba estructurar el trabajo de los empleados en el nuevo sistema.
Organización del trabajo con datos en Passwork
El objetivo era construir un sistema equilibrado y flexible que combinara el control con la libertad de un espacio de información personal para los empleados. El equipo de TI estableció una estructura de gobernanza clara:
Administración centralizada — los administradores de TI otorgaron automáticamente acceso a todas las bóvedas para mantener el control
Formación personalizada sobre procedimientos seguros de exportación e importación de contraseñas para garantizar una migración de datos segura
Sesiones de incorporación para cada usuario durante la configuración para generar confianza y asegurar una adopción fluida
Directrices claras sobre qué información pertenece a las bóvedas organizacionales compartidas y a las bóvedas personales
Con Passwork, los usuarios ganaron la flexibilidad de crear y organizar bóvedas según los requisitos de su flujo de trabajo.
Incorporación de usuarios
Durante el despliegue, el equipo de TI descubrió que las sesiones de formación centralizadas eran ineficaces — muchos empleados encontraban difícil absorber toda la información de una vez. Se eligió un nuevo método en su lugar: un enfoque personalizado destinado a animar a los usuarios a aceptar el producto, usar contraseñas fuertes y generadas, compartir credenciales de forma segura y aprender a usar Passwork eficazmente.
«La adopción de Passwork está siendo muy buena: los empleados se están adaptando fácilmente a las nuevas funciones. Hay una sesión informativa personal para cada usuario que configuramos. Esto también cubre los requisitos de seguridad y guía sobre cómo utilizar la herramienta de manera efectiva. Los empleados ya están organizando su espacio para adaptarlo a su estructura, pensando en cómo diseñar las bóvedas.»
El personal siempre tiene acceso a las instrucciones de usuario, y el departamento de TI proporciona soporte continuo para resolver cualquier pregunta que surja.
Resultado: Seguridad y eficiencia en los flujos de trabajo
Después de más de un año en uso, la ciudad de Melle sigue muy satisfecha con Passwork. La solución es utilizada activamente por los empleados de oficina hoy en día. Los siguientes puntos se destacaron como particularmente positivos.
Espacio seguro unificado para el almacenamiento de datos
El municipio ha abandonado las soluciones basadas en navegador: todas las contraseñas ahora se almacenan en un sistema seguro con cifrado multinivel. El acceso a ellas está estrictamente controlado y registrado — esto ayuda a prevenir filtraciones y permite la investigación de incidentes si es necesario.
Aceptación positiva de los usuarios
Muchos empleados han adoptado la herramienta y están pensando proactivamente en cómo estructurar las bóvedas organizacionales.
Soporte al cliente fiable
El equipo de soporte de Passwork desempeñó un papel importante en la implementación exitosa y la actualización de la versión 6 a la recientemente lanzada Passwork 7.
«El soporte al cliente ha sido excelente hasta ahora con sus respuestas rápidas. Siempre tengo respuestas a mis preguntas, siempre con los scripts correctos incluidos o la sintaxis correcta que necesitaba introducir, todo ya preparado. Perfecto.»
La ciudad de Melle planea continuar desplegando Passwork hasta que todos los usuarios estén incorporados con éxito. El equipo de TI ha comenzado a recopilar sistemáticamente solicitudes de funciones para perfeccionar el sistema y satisfacer los requisitos específicos de la infraestructura de TI de la administración municipal y asegurar que se alinee con sus necesidades operativas.
Conclusión
Passwork ha mejorado la seguridad interna en la ciudad de Melle al crear un sistema fiable para la gestión de contraseñas. A través de una evaluación cuidadosa y una estrategia de implementación centrada en la seguridad, el despliegue se realizó sin problemas. Un enfoque de incorporación personalizado impulsó una alta adopción por parte de los usuarios, mientras que la fiabilidad de la plataforma y el soporte técnico receptivo consolidaron su posición como herramienta esencial en las operaciones administrativas diarias.
¡Dé el primer paso usted también! Comience su prueba gratuita de Passwork y descubra lo fácil que puede ser la gestión segura de contraseñas.
The city of Melle, a municipality in Lower Saxony with more than 48,000 residents, is recognized for its modern approach to city administration and citizen services. The local government manages a wide range of responsibilities: urban development, education, social care, environmental protection, cultural initiatives, municipal infrastructure, and economic support for the region.
In recent years, Melle has invested heavily in digital transformation, introducing online citizen services, modernizing internal administrative workflows, and improving the technological foundation that supports daily municipal operations. The administration is known for its commitment to transparency, efficiency, and service quality — regularly receiving positive recognition from residents for its well-organized city services and proactive, solutions-oriented governance.
As a city institution, the administration is committed to upholding the highest standards of data protection and operational integrity. The city's IT team continuously seeks to implement modern technologies that streamline workflows, enhance security, and support its employees in their daily tasks. This commitment led them to reevaluate their password management approach, seeking a solution that would meet their security requirements while remaining user-friendly for employees.
Company: Stadt Melle Location: Lower Saxony, Germany Industry: City administration Company size: 450+ employees
Challenge: Unified password management without security risks
The city administration of Melle recognized a need to improve credential security across employee workflows. Different departments relied on various password management solutions, with most using the one integrated into Microsoft Edge. This resulted in isolated systems with limited central oversight, no visibility into user actions, and inconsistent security standards across the organization.
Beyond security, the IT team wanted to simplify password management for employees. The city administration employs people with varying levels of technical proficiency, so ease of use was just as important as protection.
"That was especially important to us so that we wouldn't have an additional password, another hurdle for people. So really just their Windows password and then the PIN for the browser extension at the end of the day." — Andre Kahlen, system administrator
This meant finding a solution with LDAP support — allowing users to authenticate with their existing Windows credentials and eliminating an additional barrier to adoption. This led the IT team to make a strategic decision to evaluate and introduce a centrally managed, enterprise-grade password management solution.
The main objective was to find a platform that combined three core requirements:
Security: high security that aligns with strict data protection regulations and internal security policies.
Usability: exceptional user-friendliness with seamless integration into existing IT infrastructure.
Control: simple, centralized administration that keeps data accessible while providing fast technical support.
The city of Melle required a service that could unify the workflows across all departments, establish transparent access management, and ensure secure password storage.
To select a password manager, the IT team conducted a thorough analysis of the available solutions on the market. After careful consideration, they chose Passwork for its security features, granular control, and user-friendly interface — all of which closely matched their criteria.
Passwork's ability to provide centralized control while still offering a secure space for users was beneficial to the IT team. The vault structure was also considered a deciding factor.
"We want to maintain control, since we assign many people, especially those outside of IT, to deal with passwords. One of the advantages of Passwork is centralized management."
This level of control was essential for the municipality, as administrators handle a vast amount of sensitive data and require protection that effectively prevents unauthorized access to confidential information.
The team successfully tested all the declared functions and analyzed database-level security. The decision was based on an intensive three- to four-month testing phase involving about eight members of the IT department. The entire Passwork implementation process, from initial selection to final implementation, took over a year.
LDAP integration was essential to minimize user friction. After testing, the city administration deployed Passwork within its infrastructure with the following setup:
LDAP integration for centralized user management based on Active Directory
The self-hosted solution with an additional instance for employees with heightened security requirements in an isolated network segment
Snapshot-based and classic backups to ensure data can be quickly restored in case of an incident
"We set up LDAP integration to centrally manage user accounts and permissions, which was highly important. We decided to split the solutions into several instances. Access is heavily restricted this way."
After the successful implementation, the IT team needed to structure the employees' work in the new system.
Organizing work with data in Passwork
The goal was to build a balanced and flexible system that combined control with the freedom of personal information space for employees. The IT team established a clear governance structure:
Centralized administration — IT admins automatically granted access to all vaults to maintain control
Personalized training on secure password export and import procedures to ensure safe data migration
Onboarding sessions for each user during setup to build confidence and ensure smooth adoption
Clear guidelines on what information belongs in shared organizational vaults and personal vaults
With Passwork, users gained the flexibility to create and organize vaults based on their workflow requirements.
User onboarding
During the rollout, the IT team discovered that centralized training sessions were ineffective — many employees found it challenging to absorb the information all at once. A new method was chosen instead: a personalized approach intended to encourage users to accept the product, use strong, generated passwords, share credentials securely, and learn to use Passwork effectively.
"Passwork adoption is getting very good: employees are taking to new features easily. There is a personal briefing for every user we set up. This also covers security requirements and guides how to effectively utilize the tool. Employees are already organizing their space to fit their structure, thinking about how to design vaults."
Staff always have access to user instructions, and the IT department provides ongoing support to address any questions that arise.
After more than a year in use, the City of Melle remains highly satisfied with Passwork. The solution is actively used by office employees today. The following points were highlighted as particularly positive.
Unified secure space for data storage
The municipality has abandoned browser-based solutions: all passwords are now stored in a secure system with multi-level encryption. Access to them is strictly controlled and logged — this helps prevent leaks and enables incident investigation if necessary.
Positive user acceptance
Many employees have embraced the tool and are proactively thinking about how to structure organizational vaults.
Reliable customer support
The Passwork support team played an important role in the successful implementation and upgrade from version 6 to the recently released Passwork 7.
"Customer support has been excellent so far with its fast responses. I always have answers to my questions, always with the right scripts included or the right syntax I needed to enter, everything already prepared. Perfect."
The City of Melle plans to continue rolling out Passwork until all users are successfully onboarded. The IT team has begun systematically gathering feature requests to refine the system to meet the specific requirements of the city administration's IT infrastructure and to ensure it aligns with their operational needs.
Conclusion
Passwork has improved the internal security at the City of Melle by creating a reliable system for password management. Through careful evaluation and a security-focused implementation strategy, the deployment proceeded smoothly. A tailored onboarding approach drove high user adoption, while the platform's reliability and responsive technical support solidified its position as an essential tool in daily administrative operations.
Take the first step too! Start your free Passwork trial and see how easy secure password management can be.
Password management is the practice of securely creating, storing, organizing, and controlling access to passwords and other authentication credentials. It combines human processes with specialized software tools to ensure that every account uses a strong, unique password without requiring users to memorize them all.
Whether you're an individual trying to secure your online life or an IT administrator protecting your organization's digital assets, understanding password management is essential.
This guide explains everything you need to know: what password management is, why it matters, how it works, and how to implement it effectively. You'll learn about different types of password managers, key features to look for, and best practices that protect you from the most common security threats.
Understanding password management
At its core, password management addresses a fundamental challenge: humans are terrible at creating and remembering secure passwords. We default to predictable patterns, recycle familiar combinations across accounts, and prioritize convenience over security.
Password management systems compensate for these inherent limitations by assuming the cognitive burden and complexity on our behalf. As both a practice and a technology, password management encompasses several key functions:
Password generation: Creating strong, random passwords that meet security requirements and resist common attack methods like brute force and dictionary attacks.
Secure storage: Encrypting and storing passwords in a protected vault that only authorized users can access.
Organization: Categorizing and managing credentials across hundreds of accounts, making them easy to find when needed.
Access control: Determining who can access which passwords, particularly important in team and enterprise environments.
Autofill and automation: Automatically entering credentials into login forms, reducing friction while maintaining security.
Audit trails: Recording who accessed which credentials and when, allowing security teams to detect suspicious activity, investigate incidents, and maintain compliance with regulatory requirements.
Password management has evolved from rudimentary practices to sophisticated security infrastructure. The first generation of digital password managers introduced basic encryption (like Blowfish algorithm) and centralized storage, addressing immediate security gaps but lacking the granular controls enterprises required.
Modern password management systems represent a fundamental shift: they combine military-grade encryption, zero-knowledge architecture, role-based access controls, and comprehensive audit capabilities. Today's solutions enforce security policies, detect anomalies, integrate with existing infrastructure, and provide the visibility organizations need to maintain compliance and respond to threats in real time.
Why is password management important?
According to Verizon's 2025 Data Breach Investigations Report, stolen credentials served as the initial access vector in 22% of all confirmed breaches, with that figure jumping to 88% for basic web application attacks.
In the first half of 2025 alone, over 8,000 global data breaches exposed approximately 345 million records, demonstrating the persistent and catastrophic scale of credential-based attacks. Behind these statistics lies a fundamental incompatibility between human cognition and modern security demands.
The human factor
Our brains simply weren't designed for this pace of information. Psychological research shows that humans can reliably remember only 7±2 pieces of data in working memory. Yet we're expected to manage hundreds of unique, complex passwords — each a random string of uppercase letters, lowercase letters, numbers, and symbols.
Faced with this impossible task, people develop coping mechanisms that undermine security:
Predictable patterns: Adding "123" or "!" to meet complexity requirements.
Password reuse: Over 60% of people reuse passwords across multiple accounts.
Writing passwords down: Sticky notes on monitors remain surprisingly common.
Simple passwords: "password," "123456," and "qwerty" still rank among the most common passwords globally.
This behavior isn't laziness. It's a rational response to an overwhelming cognitive burden. Password fatigue is real, and it leads to security shortcuts.
Password fatigue is the mental exhaustion and frustration users experience from creating, remembering, managing, and resetting an excessive number of passwords across multiple accounts.
The consequences of poor password hygiene
When password security fails, the consequences cascade:
For individuals: Identity theft, financial fraud, privacy violations, and the time-consuming process of recovering compromised accounts. The average victim of identity theft spends 200 hours resolving the issue.
For businesses: Data breaches cost an average of $4.44 million per incident, according to IBM's Cost of a Data Breach Report. Beyond direct financial losses, organizations face regulatory fines, legal liability, reputational damage, and loss of customer trust.
For IT teams: Password-related help desk tickets consume 20-50% of IT support resources in typical organizations. Every "forgot password" request represents time that could be spent on strategic initiatives.
Enhanced security: Unique, strong passwords for every account eliminate the domino effect of credential reuse. Even if one password is compromised, your other accounts remain secure.
Reduced cognitive load: You remember one master password instead of hundreds. The mental relief is immediate and significant.
Time savings: Autofill eliminates the minutes spent typing or resetting passwords. For organizations, this translates to thousands of hours of productivity annually.
Compliance support: Many regulations (GDPR, HIPAA, SOC 2) require organizations to demonstrate proper credential management. Password managers provide the audit trails and controls needed for compliance.
Improved user experience: Seamless access to accounts without the friction of password resets or account lockouts.
How does password management work?
Understanding the mechanics of password management helps you appreciate both its security and its usability. Modern password managers balance strong encryption with user-friendly access.
The master password concept
Everything starts with your master password — the single password you need to remember. This password unlocks your encrypted vault containing all your other credentials.
Many users create master passwords using passphrases, random words strung together like correct-horse-battery-staple, which are both secure and memorable.
The XKCD comic that popularized this concept demonstrated a crucial insight: four or five random common words create more entropy (randomness) than a shorter complex password, while being far easier to remember.
The encrypted vault
Your password vault is an encrypted database that stores all your credentials, notes, and other sensitive information. Modern password managers use AES-256 encryption, the same standard used by governments and militaries worldwide.
Here's what makes it secure:
Encryption at rest: Your data is encrypted before it leaves your device. Even the password manager company cannot read your vault contents.
Zero-knowledge architecture: The service provider never has access to your master password or unencrypted data. If their servers are breached, your passwords remain protected.
Encryption in transit: When syncing across devices, your encrypted vault travels through secure channels (TLS/SSL), adding another layer of protection.
On-premise password managers such as Passwork take this further. Your encrypted vault never leaves your infrastructure — no cloud sync, no external servers, no third-party access. The data stays on your servers, behind your firewall, under your access controls.
The user journey
Here's how password management works in practice:
Initial setup: You create your master password, set up your account and security settings — multi-factor authentication, access controls, and vault parameters.
Adding passwords: As you log into existing accounts, the password manager detects login forms and offers to save your credentials. You can also manually add passwords or import them from browsers or other password managers.
Password generation: When creating new accounts, the password manager generates strong, random passwords according to the site's requirements. You never need to think about password creation again.
Autofill: When you visit a login page, the password manager recognizes the site and offers to fill in your credentials. One click, and you're logged in.
Syncing: Your encrypted vault syncs across all your devices — phone, tablet, laptop, desktop. Changes made on one device appear everywhere.
Secure sharing: When you need to share credentials with family members or team members, the password manager encrypts and transmits them securely, without exposing them in plain text.
Types of password managers
Password managers vary significantly in architecture, security model, and deployment options. Understanding these differences is essential for selecting the right solution.
Browser-based password managers
Built into web browsers like Chrome, Firefox, Safari, and Edge, these password managers offer basic functionality without additional software.
Pros:
Free and immediately available
Seamless integration with the browser
Automatic syncing across devices using the same browser
No learning curve
Cons:
Limited to browser-only passwords
Basic security features compared to dedicated solutions
Vulnerable if browser account is compromised
Limited sharing capabilities
Inconsistent cross-browser functionality
Best for: Casual users with simple needs who primarily use one browser ecosystem.
Standalone password managers
These applications store your encrypted password vault locally on your device rather than in the cloud. Designed for individual use, they prioritize local control over multi-device convenience.
Pros:
Complete control over your data
No reliance on cloud services
Works offline
Maximum privacy
Cons:
Manual syncing across devices
Risk of data loss if device fails without backups
Less convenient for multi-device users
Requires more technical knowledge
Best for: Privacy-conscious users, those with limited internet connectivity, or anyone who prefers local data storage.
Cloud-based password managers
The most popular category, these services store your encrypted vault on their servers and sync it across all your devices.
Potential target for attackers (though encryption protects data)
Best for: Most individual users, families, and small teams who want convenience and comprehensive features.
Enterprise password managers
Designed for organizations, these solutions add administrative controls, compliance features, integration with corporate systems and are deployed on-premise. This architecture eliminates dependencies on external providers. You define the security perimeter, manage access controls, and maintain complete operational independence.
Pros:
Complete data sovereignty
Zero external dependencies or cloud service providers
Automatic compliance with data residency regulations
Integration with Active Directory, LDAP, and SSO systems
Centralized administration with granular policy enforcement
Role-based access controls and privileged access management
Comprehensive audit logs and compliance reporting
Automated onboarding/offboarding workflows
Protection from provider-side security incidents
Cons:
Higher upfront infrastructure and licensing costs
More complex setup and administration
May require IT expertise
Organization manages backups and disaster recovery
Best for: Businesses of all sizes, IT teams managing shared credentials, organizations with compliance requirements.
Key features of password managers
Modern password managers offer far more than basic password storage. Understanding these features helps you evaluate solutions and maximize their value.
Core features
Password generation: Creates strong, random passwords based on customizable criteria (length, character types, symbol inclusion). The best generators create passwords that resist brute force attacks for centuries.
Secure storage: Encrypted vault for passwords, with many managers also storing secure notes, credit card information, identity documents, and other sensitive data.
Autofill: Automatically detects login forms and fills credentials with one click or tap. Advanced autofill distinguishes between similar sites to prevent phishing attacks.
Cross-platform syncing: Keeps your vault synchronized across Windows, macOS, Linux, iOS, Android, and web browsers.
Browser extensions: Integrations for Chrome, Firefox, Safari, Edge, and other browsers that enable autofill and password capture.
Mobile apps: Full-featured applications for smartphones and tablets, often with biometric authentication.
Security features
Multi-factor authentication (MFA): Adds a second verification step beyond your master password. Options include authenticator apps (TOTP), SMS codes, hardware keys (YubiKey), or biometric verification.
Biometric authentication: Unlock your vault using fingerprint, face recognition, or other biometric methods on supported devices.
Security dashboard: Analyzes your passwords and identifies:
Weak passwords that don't meet security standards
Reused passwords across multiple accounts
Old passwords that haven't been changed recently
Zero-knowledge architecture: Ensures that even the password manager company cannot access your unencrypted data.
Emergency access: Designates trusted contacts who can access your vault after a waiting period if you become incapacitated.
Sharing and collaboration features
Secure sharing: Share individual passwords or entire folders with family members or team members without exposing passwords in plain text.
Team accounts: Organize passwords by department, project, or access level with role-based permissions.
Access controls: Define who can view, use, or modify specific passwords.
Sharing history: Track when passwords were shared, accessed, or modified.
Advanced features
Password history: Maintains previous versions of passwords, allowing you to revert if needed.
Secure notes: Store sensitive information beyond passwords — software licenses, WiFi credentials, server details, recovery codes.
API access: For developers and power users, programmatic access to the password manager.
CLI tools: Command-line interfaces for integrating password management into development workflows.
Audit logs: Detailed records of all vault activities for security monitoring and compliance.
Password management best practices
Having a password manager is only the first step. Following these best practices ensures you're using it effectively and securely.
1. Create an unbreakable master password
Your master password is the single point of failure for your entire password security. Make it count:
Use at least 16 characters (longer is better)
Combine random words into a memorable passphrase
Avoid personal information (names, dates, addresses)
Never reuse a password you've used anywhere else
2. Enable multi-factor authentication
Add a second layer of security to your password manager account. Even if someone discovers your master password, they can't access your vault without the second factor. Authenticator apps (Passwork 2FA, Google Authenticator, Authy) are more secure than SMS codes. Hardware security keys (YubiKey) offer the strongest protection.
3. Use unique passwords for every account
This is the fundamental rule of password security. Your password manager makes it effortless — let it generate a unique password for each account. If one site is breached, your other accounts remain secure.
4. Generate long, complex passwords
When creating passwords, maximize length and complexity:
Aim for 16-20 characters minimum
Use all character types (uppercase, lowercase, numbers, symbols)
Let the password manager generate them randomly
5. Conduct regular password audits
Schedule quarterly reviews using your password manager's security dashboard:
Update weak passwords
Eliminate reused passwords
Change old passwords (especially for critical accounts)
Remove passwords for accounts you no longer use
6. Respond immediately to breach alerts
When your password manager notifies you of a compromised password, change it immediately. Don't wait, breached credentials are often exploited within hours.
7. Organize your vault thoughtfully
Create a logical structure:
Use folders or tags to categorize passwords (Work, Personal, Finance, etc.)
Add notes to passwords with security questions, account numbers, or other relevant information
Mark critical accounts for easy identification
8. Back up your vault regularly
While cloud-based password managers handle backups automatically, consider:
Exporting an encrypted backup periodically
Storing the backup in a separate secure location
Testing your backup to ensure it works
9. Set up emergency access
Designate a trusted person who can access your vault if something happens to you. Most password managers offer emergency access features with configurable waiting periods.
10. Use secure sharing features
When sharing passwords with team members:
Use the password manager's built-in sharing features
Never send passwords via email, text, or messaging apps
Revoke access immediately when no longer needed
Regularly review who has access to shared passwords
11. Keep your password manager updated
Enable automatic updates to ensure you have the latest security patches and features. This applies to browser extensions, mobile apps, and desktop applications.
12. Avoid common mistakes
Don't store your master password in your vault (circular dependency)
Don't share your master password with anyone, ever
Don't use password manager autofill on public or shared computers
Don't ignore security warnings from your password manager
Yes, when properly implemented, password managers are significantly safer than the alternatives (reusing passwords, writing them down, or using weak passwords). They use military-grade AES-256 encryption and zero-knowledge architecture, meaning even the password manager company cannot access your unencrypted data. While no system is 100% invulnerable, password managers have proven track records and are recommended by security experts, including the NSA and CISA.
Can password managers be hacked?
While password managers can theoretically be targeted by attackers, successful attacks are extremely rare and typically require sophisticated techniques. The encryption used is virtually unbreakable with current technology. Most "password manager breaches" you hear about involve compromised user accounts (weak master passwords, no MFA) rather than flaws in the password manager itself. Using a strong master password and enabling multi-factor authentication makes your password manager highly resistant to attacks.
Should I use a free or paid password manager?
Free password managers provide adequate security for basic needs. Paid password managers offer additional features like advanced sharing, priority support, dark web monitoring, and more storage. For individuals, free options are often sufficient. For families and businesses, paid plans provide better collaboration tools and administrative controls. The most important factor is choosing a reputable password manager and using it consistently, regardless of whether it's free or paid.
Can I share passwords safely with family or team members?
Yes, modern password managers include secure sharing features that encrypt passwords before transmission. You can share individual passwords or entire folders with specific people, and you can revoke access at any time. This is far safer than sending passwords via email, text, or messaging apps. Family plans typically allow each person to have their own vault plus shared family folders. Business plans offer more granular permission controls.
Do I need a password manager if I use two-factor authentication?
Yes. Two-factor authentication (2FA) and password managers serve complementary purposes. 2FA adds a second verification step beyond your password, providing protection even if your password is compromised. However, you still need strong, unique passwords for each account — which is what password managers provide. In fact, many password managers can also store and autofill 2FA codes, making the combination even more convenient.
Can I use a password manager on public or shared computers?
It's generally not recommended to use your password manager on public computers (libraries, internet cafes) or shared computers (hotel business centers) due to the risk of keyloggers or other malware. If you must access accounts from a public computer, use your password manager's web vault in a private/incognito browser window, log out completely when finished, and change your master password afterward.
Conclusion
Password management isn't optional anymore — it's essential infrastructure for digital life. The average person manages hundreds of accounts, each requiring secure authentication. Trying to remember unique, strong passwords for every account is impossible, and the alternatives — password reuse, weak passwords, or written notes — create serious security vulnerabilities.
Password managers solve this problem. They generate strong passwords, store them securely with military-grade encryption, and autofill them when needed. You remember one master password; the password manager handles everything else.
The benefits extend beyond security. Password managers save time, reduce frustration, improve productivity, and support compliance requirements. For businesses, they reduce help desk burden and protect against the costly consequences of data breaches.
Passwork is an EU-based company with a trusted name in cybersecurity delivering enterprise-grade password management solution designed for organizations that demand full control over their security infrastructure.
With on-premise deployment at its core, Passwork ensures complete data ownership, zero-knowledge encryption, and compliance with industry regulations — backed by ISO 27001 certification.
Take the first step today. Start your free Passwork trial and see how easy secure password management can be.
Every time you connect to a Wi-Fi network, send a message through an encrypted app, or access your bank account online, you're relying on encryption to keep your data safe. At the heart of this digital security infrastructure stands the Advanced Encryption Standard (AES) — the encryption algorithm trusted by everyone from individual users to intelligence agencies protecting classified information.
AES is a symmetric-key encryption algorithm that transforms readable data (plaintext) into an unreadable format (ciphertext) using a secret key. Since its adoption by the National Institute of Standards and Technology (NIST) in 2001, AES has become the global standard for data encryption, trusted by governments, financial institutions, and technology companies worldwide.
This guide will walk you through everything you need to know about AES: from its fundamental principles to advanced implementation strategies, regulatory compliance, and its resilience against emerging quantum computing threats.
What is the Advanced Encryption Standard (AES)?
The Advanced Encryption Standard (AES) is a symmetric-key block cipher that encrypts data in fixed-size blocks of 128 bits using keys of 128, 192, or 256 bits. Originally known as the Rijndael cipher, AES was developed by Belgian cryptographers Vincent Rijmen and Joan Daemen and selected by NIST in 2001 to replace the aging Data Encryption Standard (DES).
Unlike asymmetric encryption algorithms such as RSA, which use different keys for encryption and decryption, AES uses the same secret key for both operations. This symmetric approach makes AES exceptionally fast and efficient, particularly for encrypting large volumes of data.
The U.S. National Security Agency (NSA) approved AES-256 for protecting information classified as TOP SECRET, cementing its status as a military-grade encryption standard. Today, AES is mandated by the Federal Information Processing Standard (FIPS 197) and has been adopted globally as the de facto encryption standard for both commercial and government applications.
From DES to AES: A brief history
By the mid-1990s, the Data Encryption Standard (DES), which had served as the primary encryption standard since 1977, was showing its age. With a key length of only 56 bits, DES had become vulnerable to brute-force attacks as computing power increased. In 1997, NIST launched a public competition to select a new encryption standard that would be secure, efficient, and flexible enough to meet the needs of the 21st century.
The AES competition attracted 15 submissions from cryptographers around the world. After three years of rigorous analysis, testing, and public scrutiny, the Rijndael cipher emerged as the winner. NIST officially adopted AES as a federal standard in November 2001, and it was published as FIPS 197 in December of that year.
The selection of Rijndael was based on its superior combination of security, performance, and versatility. Unlike many competing algorithms, Rijndael could efficiently operate on various hardware platforms — from high-performance servers to resource-constrained embedded systems — while maintaining strong cryptographic properties.
How AES encryption works?
AES operates as a substitution-permutation network, performing multiple rounds of transformations on the data. The number of rounds depends on the key size: 10 rounds for AES-128, 12 rounds for AES-192, and 14 rounds for AES-256.
Before encryption begins, the algorithm expands the original key into a series of round keys through a process called key expansion. Each round then applies four distinct operations to scramble the data:
SubBytes: This step provides non-linear substitution by replacing each byte in the data block with a corresponding value from a fixed substitution table called the S-box. This operation is crucial for AES's resistance to cryptanalysis, as it introduces confusion into the encryption process.
ShiftRows: The bytes in each row of the data matrix are cyclically shifted by different offsets. The first row remains unchanged, the second row shifts one position to the left, the third row shifts two positions, and the fourth row shifts three positions. This operation provides diffusion by spreading the data across the entire block.
MixColumns: Each column of the data matrix is transformed using a mathematical operation in the Galois Field GF(2^8). This step combines the bytes within each column, ensuring that changes to a single input byte affect multiple output bytes. The MixColumns operation is skipped in the final round.
AddRoundKey: The round key is combined with the data block using a bitwise XOR operation. This step incorporates the secret key material into the encrypted data, ensuring that without the correct key, the ciphertext cannot be decrypted.
After all rounds are complete, the output is the encrypted ciphertext. Decryption reverses this process using inverse operations in the opposite order.
AES key sizes: 128, 192, or 256 Bits?
AES supports three key lengths, each offering different levels of security and performance characteristics:
AES-128 uses a 128-bit key and performs 10 encryption rounds. It provides 128 bits of security, which translates to 2^128 possible key combinations — approximately 340 undecillion possibilities. For context, testing one billion keys per second would require billions of years to exhaust all possibilities. AES-128 is suitable for most commercial applications and offers the best performance of the three variants.
AES-192 uses a 192-bit key and performs 12 rounds. While less commonly implemented than AES-128 or AES-256, it offers an intermediate security level for organizations that want additional protection without the performance overhead of AES-256.
AES-256 uses a 256-bit key and performs 14 rounds. Often referred to as "military-grade encryption," AES-256 is approved by the NSA for protecting TOP SECRET information. The 256-bit key space provides 2^256 possible combinations, making it computationally infeasible to break through brute-force attacks, even with future advances in computing technology.
For most applications, AES-128 provides more than adequate security. However, organizations handling highly sensitive data, operating in regulated industries, or concerned about long-term data protection often choose AES-256. The performance difference between AES-128 and AES-256 is minimal on modern hardware, particularly on processors with AES-NI (AES New Instructions) hardware acceleration.
Understanding AES modes of operation
While AES encrypts data in 128-bit blocks, real-world applications typically need to encrypt data that's much larger than a single block. Modes of operation define how AES processes multiple blocks of data and how it handles data that doesn't fit evenly into 128-bit blocks.
ECB (Electronic Codebook) is the simplest mode, encrypting each block independently with the same key. However, ECB has a critical weakness: identical plaintext blocks produce identical ciphertext blocks, revealing patterns in the encrypted data. ECB should never be used for encrypting anything beyond single blocks of random data.
CBC (Cipher Block Chaining) addresses ECB's weakness by XORing each plaintext block with the previous ciphertext block before encryption. This creates a chain effect where each block depends on all previous blocks. CBC requires an initialization vector (IV) — a random value used to encrypt the first block. While CBC is widely used and secure when implemented correctly, it cannot be parallelized and is vulnerable to padding oracle attacks if not properly implemented.
GCM (Galois/Counter Mode) is the recommended mode for most modern applications. GCM combines the counter mode of encryption with Galois field multiplication to provide both confidentiality and authentication. Unlike CBC, GCM can be parallelized for better performance and produces an authentication tag that verifies data integrity. This authenticated encryption approach protects against tampering and certain types of attacks that can compromise CBC implementations.
CTR (Counter Mode) turns AES into a stream cipher by encrypting a counter value and XORing the result with the plaintext. CTR mode is parallelizable and doesn't require padding, making it efficient for high-performance applications. However, CTR alone doesn't provide authentication, so it's often combined with a separate authentication mechanism.
For new implementations, security experts recommend using AES-GCM. Its combination of encryption and authentication in a single operation, along with its performance characteristics, makes it the preferred choice for protocols like TLS 1.3, IPsec, and modern VPN implementations.
Why AES remains the global standard
More than two decades after its adoption, AES continues to dominate the encryption landscape for several compelling reasons:
Unbroken Security: Despite extensive cryptanalysis by researchers worldwide, no practical attack has been found that can break properly implemented AES encryption. The best known attacks against AES-256 are theoretical and require computational resources far beyond anything currently available.
Exceptional Performance: AES is designed for efficiency on both hardware and software implementations. Modern processors include dedicated AES-NI instructions that accelerate AES operations by up to 10 times compared to software-only implementations. The hardware encryption market, which includes AES-accelerated processors, is projected to grow from $359.5 million in 2025 to $698.7 million by 2032.
Widespread Adoption: According to a 2025 survey, 46.2% of U.S. Managed Service Providers favor AES as their primary encryption method. This widespread adoption creates a virtuous cycle: more implementations lead to better-tested code, more hardware support, and increased interoperability.
Regulatory Compliance: AES is mandated or recommended by numerous regulatory frameworks, including FIPS 197, GDPR, HIPAA, and PCI DSS. This regulatory acceptance makes AES the safe choice for organizations operating in regulated industries.
Real-world applications of AES
AES encryption protects data across virtually every digital domain:
Network Security: AES secures internet communications through HTTPS (using TLS/SSL protocols), protects VPN connections, and encrypts Wi-Fi networks through WPA2 and WPA3 standards. Every time you see a padlock icon in your browser, AES is likely protecting your data in transit.
Data Storage: Operating systems use AES for full-disk encryption (BitLocker on Windows, FileVault on macOS, LUKS on Linux). Cloud storage providers encrypt data at rest using AES-256, with the cloud encryption market holding a 69% share in 2024.
Mobile Devices: Smartphones use AES to encrypt stored data, secure messaging applications, and protect mobile payment transactions. The encryption happens transparently in the background, with dedicated hardware accelerators ensuring minimal impact on battery life.
Financial Services: Banks and payment processors rely on AES to protect financial transactions, secure ATM communications, and encrypt sensitive customer data. The Payment Card Industry Data Security Standard (PCI DSS) specifically requires strong encryption for cardholder data.
Healthcare: Medical institutions use AES-256 to protect electronic Protected Health Information (ePHI) as required by HIPAA regulations. The 2025 HIPAA updates mandate encryption for ePHI, with AES as the de facto standard and requirements for Hardware Security Modules (HSMs) for key management.
Password Managers: Modern password managers like Passwork rely on AES-256 encryption to protect your stored credentials, ensuring that even if someone gains access to your password vault file, they cannot read its contents without your master password.
Government and Military: AES-256 is approved for protecting classified information up to the TOP SECRET level, making it the encryption standard for government communications, military operations, and intelligence agencies.
AES and regulatory compliance
For organizations operating in regulated industries, AES encryption is often a compliance requirement:
FIPS 197 is the official NIST standard that defines AES. Organizations working with the U.S. federal government must use FIPS 197-validated cryptographic modules, ensuring that their AES implementations meet rigorous security standards.
GDPR requires organizations to implement "appropriate technical and organizational measures" to protect personal data. While GDPR doesn't mandate specific encryption algorithms, AES-256 is widely recognized as meeting the regulation's requirements for strong encryption.
HIPAA mandates encryption for electronic Protected Health Information (ePHI). The 2025 HIPAA updates specifically require encryption both in transit and at rest, with AES-256 recommended as the standard and HSMs required for secure key management.
PCI DSS requires merchants and service providers to encrypt cardholder data during transmission and storage. AES is explicitly mentioned as an acceptable encryption algorithm for meeting PCI DSS
The future of AES: Quantum computing and beyond
The emergence of quantum computing has raised questions about the future of encryption. Quantum computers leverage quantum mechanical phenomena to perform certain calculations exponentially faster than classical computers. Shor's algorithm, running on a sufficiently powerful quantum computer, could break RSA and other asymmetric encryption schemes that rely on the difficulty of factoring large numbers.
However, symmetric encryption algorithms like AES are significantly more resistant to quantum attacks. The primary quantum threat to AES comes from Grover's algorithm, which can search through possible keys faster than classical brute-force attacks. Grover's algorithm effectively halves the security level of symmetric encryption — meaning AES-256 would provide 128 bits of security against quantum attacks, and AES-128 would provide 64 bits.
This is why security experts recommend AES-256 for data that needs long-term protection. Even in a post-quantum world, AES-256 will remain secure, providing the equivalent of 128-bit security — still far beyond the reach of any conceivable quantum computer.
In August 2024, NIST released the first three finalized Post-Quantum Cryptography (PQC) standards: FIPS 203, 204, and 205. These standards focus on quantum-resistant asymmetric algorithms for key exchange and digital signatures. The recommended approach for the quantum era is hybrid encryption: using post-quantum algorithms to securely exchange keys, then using AES to encrypt the actual data.
Frequently Asked Questions
Is AES encryption breakable?
No practical attack exists that can break properly implemented AES encryption. The best known attacks are theoretical and require resources far beyond current capabilities. AES-256, in particular, is considered computationally infeasible to break through brute-force methods.
How long would it take to crack AES-256?
Using current technology, a brute-force attack on AES-256 would require testing 2^256 possible keys. Even if you could test one trillion keys per second, it would take longer than the age of the universe to try all possibilities.
What is the difference between AES and RSA?
AES is a symmetric encryption algorithm that uses the same key for encryption and decryption, making it fast and efficient for encrypting large amounts of data. RSA is an asymmetric algorithm that uses different keys for encryption and decryption, making it suitable for secure key exchange and digital signatures but much slower than AES.
Can quantum computers break AES?
Quantum computers pose less threat to AES than to asymmetric algorithms like RSA. While Grover's algorithm can speed up brute-force attacks, it only halves the effective key length. AES-256 remains secure even against quantum attacks, providing 128 bits of effective security.
What is the best AES mode to use?
For most modern applications, AES-GCM is the recommended mode. It provides both encryption and authentication, can be parallelized for better performance, and is the standard mode used in TLS 1.3 and other modern protocols.
Is AES-128 still secure in 2025?
Yes, AES-128 remains secure for most applications. It provides 128 bits of security, which is computationally infeasible to break with current or foreseeable technology. However, organizations handling highly sensitive data or concerned about long-term protection often choose AES-256.
Conclusion
The Advanced Encryption Standard has proven to be one of the most successful cryptographic standards in history. More than two decades after its adoption, AES remains unbroken, widely implemented, and continues to protect the vast majority of encrypted data worldwide.
As we move into an era of quantum computing and increasingly sophisticated cyber threats, AES-256 stands ready to continue its role as the workhorse of data encryption. Its combination of strong security, excellent performance, and regulatory acceptance ensures that AES will remain the encryption standard of choice for years to come.
Whether you're a developer implementing encryption in your applications, a business leader ensuring compliance, or simply someone who wants to understand how your data is protected, AES represents the gold standard in modern cryptography. By using strong encryption, maintaining secure key management practices, and staying informed about emerging threats, you can leverage AES to protect your most sensitive data in an increasingly connected world.
Ready to take control of your credentials? Start your free Passwork trial and explore practical ways to protect your business.
Ana Moore
Eirik Salmi
Eirik Salmi
