KON-VAULT Password manager for teams
For IT service providers and teams managing credentials for many clients: passwords, devices and files per client in one place, passwords and files stored encrypted, usage traceable in the activity log.
Sample view with sample data
- AES-256-GCM for passwords and files
- Activity log
- Cloud or self-hosted
Current status: Features marked In an upcoming update will ship with one of the next KON-VAULT updates. Features your administrator switches on afterwards also carry the label can be enabled. Everything else on this page is available today. Overview of upcoming features
Storage
Everything about a client in one place
KON-VAULT organises credentials by client. Each client record holds passwords, devices with serial number and version, files and notes. Earlier values are kept.
- Passwords, devices (server, client, firewall, card terminal) and files per client
- Search by client number or order code
- Passwords, serial numbers and file contents are stored AES-256-GCM encrypted in the database; titles, notes and client master data are not
- Reveal values on click, then copy with one click
- Version history: administrators see earlier values and download older file versions
- Deactivate and restore clients and entries
The server encrypts stored data with your instance’s key. This protects the encrypted values in database copies, as long as the instance key is kept separately. To display values the application decrypts them. Roles decide who may see them, and the activity log records who viewed them.
Sign-in and accounts
Sign-in and accounts decide who gets in
Users sign in with user name and password, plus a second factor via authenticator app if set up. Administrators assign roles and can deactivate accounts individually.
- Two-factor sign-in with an authenticator app (TOTP, 8-digit codes), set up per account
- Administrator and user roles
- A deactivated account loses access immediately, including through its API keys
Each account sets up its own second factor. There is no requirement for all accounts.
Sample flow with sample data
Log and alerts
See who accessed what, and when
The activity log records who signed in, whose sign-in failed and who displayed, created or changed values.
- Activity log for administrators: sign-ins, failed attempts, displayed values and changes
- View per day with search
Sample flow with sample data
API
Create entries from your own systems
Through the REST API your systems create clients, passwords, files and devices directly in KON-VAULT. Reading and changing are not part of the API. The documentation is built into the application.
- API keys per account, API access switchable per account
Sample view with sample data
OutlookIn an upcoming update
What one of the next updates adds
The following features will ship with one of the next KON-VAULT updates and are not available yet. Some take effect right away, others your administrator switches on deliberately; each is marked accordingly.
Sharing via one-time linkIn an upcoming update
Share credentials without leaving them in email or chat
A contractor needs the router password for a moment? Instead of sending it by email or chat, you create a one-time link. The content is encrypted in your browser and the key lives only in the link. Of the content, the KON-VAULT server stores only the ciphertext, plus administrative details such as expiry, number of views and an optional recipient label. It deletes the ciphertext after the last retrieval.
1Check
You choose validity (1 hour, 24 hours or 7 days) and the number of views, and confirm that you verified the recipient’s identity.
2Fetch value
For a vault entry, the KON-VAULT server sends the value to your browser once, and that is logged. A free-form secret you simply type in.
3Encrypt
Your browser encrypts the content with AES-256-GCM. The key sits in the link after the # sign, a part browsers do not send to the server when opening it.
4Store
The server’s link store receives only the ciphertext of the content and a verifier. Without the link the server cannot read the content. If you share a password from the vault, the entry shows “rotation recommended” from now on.
5Deliver
You send the link as usual and an optional link password through a second channel, by phone for example.
6Open
The recipient opens the link, no account needed. The page loads the content only after a click and decrypts it in their browser.
7Used up
After the last view, on expiry or revocation the server deletes the ciphertext. The log shows when the link was opened.
Sample flow with sample data
- Sensitivity “High” enforces a single view, at most 24 hours and a link password.
- The link password is derived in the browser (PBKDF2, 600,000 iterations). After 5 wrong attempts the link locks.
- Share passwords, files (up to 10 MB by default) and free text without a vault entry.
- Shares overview: all your links with status, accesses and revoke.
- Simple link previews in chat apps do not use up a view. Automatic link scanners in some email programs can, a link password prevents that.
Whoever holds the complete link can open it. If someone opens it first, that uses up a view. With a single view the recipient then finds it used up, and that gets noticed; with several views only the access count in the shares overview shows it. For sensitive data, choose a single view and send the link password through a second channel.
Good to know: end-to-end here means the KON-VAULT server cannot read the link content. Vault entries themselves are decrypted by the server before it hands them to your browser. One-time links require an HTTPS address, and your administrator decides who may create them: everyone, administrators only or nobody. Server backups may still contain the ciphertext for a while.
Per-entry permissionsIn an upcoming update
By default every user sees all active clients. Where that does not fit, an administrator restricts a client or individual entries and grants access selectively, with an expiry date if you like.
- Restrict per client or per password, file and device: visible only to people with access can be enabled
- Grant per person with the permission Read, Read and share, or Edit
- Valid until a date, preset to 30 days, or without expiry
- Account switch “Read only”: cannot create, change or share anything, not even via the API can be enabled
- Applies everywhere: list, search, display, download, sharing and API. For people without access, a restricted entry simply is not there.
- Shares page, for administrators with an “expires within 7 days” filter; revoking takes effect immediately
Administrators still see everything. The share permission controls one-time links from the entry. Anyone allowed to read a value can pass it on, for example as a free-form secret. You can allow one-time links for administrators only; no setting prevents passing a value on by other means.
Sign-in and sessionsIn an upcoming update
- Each two-factor code works only once; recovery codes for emergencies can be generated
- Sign-in protection: after 5 failed attempts an increasing wait of up to 30 seconds, the same response for unknown user names
- Server-side sessions: a list of your sign-ins and “End all other sessions”
- Newly set passwords need at least 12 characters, no common passwords and not the user name
- New instances start with a random administrator password that must be changed at first sign-in
- Security headers, protection against cross-site requests, cookies with SameSite protection and, over HTTPS, the Secure flag
- Passkeys, once your instance runs on an HTTPS address with a host name can be enabled
- Automatic sign-out after inactivity, recommended after 30 minutes at most, with a notice one minute before can be enabled
- Hard lockout after repeated failed attempts can be enabled
- Random secrets for new two-factor setups can be enabled
Each account sets up its own second factor; there is no requirement for all accounts. The security overview shows how many accounts do not have one yet.
Log and alertsIn an upcoming update
- Access history per entry for administrators: who saw this password and when
- Filter by period, user, action and search term, export as CSV with masked values
- Security events, for example many password reveals in a short time, repeated access without permission, access after a grant expired or many failed sign-ins
- Red marker for administrators, acknowledge events one by one
- Security overview with a checklist and traffic lights, based on recommendations of the German BSI
- The application stores IP addresses only truncated or pseudonymised; log retention is configurable
- Webhook notification as JSON to a system of your choice, such as an automation that forwards to your team chat. HTTPS only, without passwords, client data or entry names. can be enabled
Follow-upIn an upcoming update
- Deactivate an account: one-time links and grants are revoked, sessions ended and passwords seen in the last 90 days flagged for change. You also get a follow-up report.
- “Device lost”: revokes the account’s one-time links, removes its passkeys and ends sessions
- A “rotation recommended” notice on the entry until a new value is saved, plus a list of all affected passwords for administrators
You change the passwords in the target systems yourself. KON-VAULT tells you which ones.
Keys and emergency exportIn an upcoming update
- A master key (KEK) wraps the data keys (DEK). You rotate the KEK without re-encrypting data; new data keys apply to newly stored values. can be enabled
- A check value detects a wrong instance root key (ENCRYPTION_KEY) at startup.
- Your administrator switches on the new storage format and migrates existing data step by step. can be enabled
- Encrypted file with all active clients and their passwords, devices and files, protected by a passphrase (Argon2id, AES-256-GCM)
- Opens offline from the command line with the KON-VAULT program, even if the server is unreachable; keep a copy of the program together with the file
- Administrators only, with account password and a fresh two-factor code, at most once per hour, recorded as a security event
Until the new format is switched on, the key ring does not cover existing data. Whoever holds both the database and the instance root key can still decrypt.
The export does not replace backups of the instance, and importing it into an instance is not supported.
APIIn an upcoming update
- Lifetime and last use visible for each key
- New keys only with a second factor set up
- Per-entry permissions and “Read only” also apply to the API
Operation
Hosted by us or by you
KON-VAULT runs as a dedicated instance in a Docker container with PostgreSQL. We operate it for you, or you run it on your own infrastructure.
Cloud
Operated by usWe run your instance and apply updates. You sign in and work.
- Your own instance for your company
- Updates by digitalWAS
- Set-up by our team
- Contact person at digitalWAS
On-Premise
On your infrastructureFor companies that want to keep credentials inside their own network.
- Docker container with PostgreSQL on your server
- Data stays in your network
- Network and proxy to your specifications
- Optionally managed by us
Enterprise
TailoredFor larger teams with specific requirements.
- Resources and operation by agreement
- Connect your systems via the API
- Customisation on request
- Personal contact
KON-VAULT
Pricing
Billing is per user per month. You receive a quote on request, ideally together with a walkthrough of your own workflows.
Cloud
- Client records with passwords, devices and files
- Activity log and version history
- Operation and updates by digitalWAS
On-Premise
- All software features of Cloud
- Installation on your infrastructure
- Data stays in your network
- Optionally managed by us
- Priority support
Enterprise
- All features of On-Premise
- Resources and operation by agreement
- Integration via the API
- Customisation on request
- Personal contact
FAQ
Frequently asked questions
Is KON-VAULT end-to-end encrypted?
No. The server encrypts passwords, serial numbers and file contents with AES-256-GCM and your instance’s key; to display them, the application decrypts them. One of the next updates brings one-time links that are end-to-end encrypted: the content is encrypted in the browser and the key exists only in the link.
How do I pass a password to someone without an account?
Today KON-VAULT shows passwords only to signed-in users. With one of the next updates you can use a one-time link: you set validity and number of views and, if needed, send a link password through a second channel. This requires an HTTPS address that recipients can reach.
Can I control who sees which client?
Today there are two roles, administrator and user, and every user sees all active clients. With one of the next updates an administrator can restrict clients or individual entries and grant access to specific people, optionally with an expiry date.
Which sign-in methods are available?
User name and password, plus a second factor via authenticator app that each account sets up itself. There is no requirement for all accounts. One of the next updates adds recovery codes and protection against password guessing, and passkeys become available as an option.
What happens when an employee leaves?
You deactivate the account. Access ends immediately, including through the account’s API keys. With one of the next updates KON-VAULT also flags the passwords they saw in the last 90 days for change and revokes their one-time links and grants.
Can I run KON-VAULT on my own servers?
Yes. KON-VAULT runs as a Docker container with PostgreSQL on your infrastructure.
Is there a trial account?
Yes. A public demo instance with sample data runs at vault.digitalwas.de; you will find the login in the “Demo” section above. It is reset every 30 minutes, so please do not store real credentials there. We are also happy to show you KON-VAULT in a walkthrough based on your own workflows.
Does KON-VAULT work on smartphones?
The application is designed for desktop browsers.
Which language is the interface in?
The KON-VAULT application interface is in German.
Quick check
Is KON-VAULT right for you?
Five short questions, then you see which variant and which features fit you.
Question 1 of 5: For how many clients do you manage credentials?
Demo
Try it yourself right away
Public demo instance with sample data. It is reset every 30 minutes, so please do not enter real credentials.
- Demo URL
- vault.digitalwas.de
- User
- admin
- Password
- admin_pw
Walkthrough
See KON-VAULT in action
We show you KON-VAULT in a walkthrough, ideally with your own workflows: client records and the activity log, and once the corresponding update has shipped, one-time links and per-entry permissions too. To try it yourself, use the demo instance alongside.
Book a walkthrough