Privacy policy

Last updated: 9 November 2026

PassAuth is a self-hosted password manager. This policy covers the PassAuth Android, iOS and desktop apps, the PassAuth browser extension, the web vault and the PassAuth server software. You choose the PassAuth server the apps connect to. It is run by you, or by the organization that gave you an account, not by the PassAuth developer.

What PassAuth handles

• Your vault: logins, passwords, verification-code keys, passkeys, cards, identities, notes and other items you save.
• Your account: your email address, your name if you add one, and sign-in tokens for your PassAuth server.
• Websites and apps you use: to suggest and fill logins, PassAuth reads the address of the current web page, or the name of the current app, and its login fields. This is used only on your device to find and fill matching logins, or to offer to save one. It is not stored or sent anywhere unless you choose to save a login, which is encrypted first.

Encryption

Vault items are encrypted on your device with keys derived from your master password (and your Secret Key, if you use one) before they are sent to your PassAuth server. The server stores only encrypted data and can't read your items, including their names and website addresses. Your master password is never sent to the server: sign-in uses the OPAQUE protocol.

Where data goes

• Encrypted vault data and account details go only to the PassAuth server address you enter.
• If "Show website icons" is on, the apps ask your PassAuth server for the icon of a website saved in your vault; the server fetches it from that website. Your server therefore learns which website addresses have icons requested, but nothing else from your vault. You can turn this off in Settings → Appearance.
• The desktop app checks GitHub (github.com) for a new version once a day and whenever you ask it to. That request sends your IP address and the app's version to GitHub, and nothing else. Website icons fetched from your server may be cached on the device, as a browser would cache them.
• The apps sync in the background: the desktop app every 2 hours by default (you can change or turn this off), the Android and iOS apps when the system allows. A background sync only refreshes the encrypted copy of your vault from your server; it doesn't unlock the vault or send anything new.
• Nothing is sent to the PassAuth developer. The apps and the extension contain no analytics, advertising, tracking or third-party services.

On your devices

• The apps keep your settings, your accounts' server addresses and sign-in tokens, and your encrypted vault data on the device. Mobile apps protect them with the device's secure key storage (Android Keystore, iOS Keychain). The desktop app keeps its sign-in tokens in the system keychain (macOS Keychain, Windows Credential Manager, the Linux secret service), along with the vault keys if you set the vault timeout to "Never", and on macOS a hand-off item with your server address, email and Secret Key that the AutoFill extension reads so you don't have to type them again. Your master password is never stored.
• While the vault is unlocked, its keys are kept in memory. If you turn on unlocking with fingerprint or face, the keys are stored encrypted with a key that only your device's biometric check can release. Your biometric data itself is handled by the device and never seen by PassAuth.
• The vault locks after the time you choose (or never, if you choose so). Logging out removes the account and its data from the device. Uninstalling the app or extension removes everything it stored.
• Copied passwords and codes are marked as sensitive and cleared from the clipboard after a delay you choose (30 seconds by default). The macOS AutoFill extension is the exception: it can't clear the clipboard, so a code you copy there stays until you copy something else.

Camera

The mobile apps use the camera only when you choose to scan a two-step login QR code while adding a verification code to an item. The image is read on your device to find the code and is never stored or sent anywhere.

Autofill and passkeys on Android, iOS and macOS

If you enable PassAuth as your autofill service or passkey provider, the operating system shows PassAuth the login fields of the app or website you're using, and the request details for passkeys. PassAuth uses them only to offer and fill your own logins and passkeys, and to save new ones you confirm. PassAuth does not use accessibility services. On macOS, the desktop app's AutoFill extension works the same way: macOS tells it which website or app asked, and it fills only logins, passkeys and one-time codes you pick.

Browser extension

The extension needs access to the websites you visit to detect login forms, fill the login you choose (only on the site it was saved for), offer to save logins and answer passkey requests. If you turn on "Make PassAuth your default password manager", it uses the browser's privacy settings to turn off the browser's own password saving and address and card autofill; turning it off gives these back to the browser.

Sharing and selling

Your data is not sold, rented or shared with anyone, is not used for advertising, and is not used for any purpose other than storing, filling and syncing your vault. The PassAuth developer has no access to it.

Deleting your account and data

You can delete your account at any time in the web vault: open your PassAuth server in a browser, sign in, and go to Settings → Account → Delete account. This permanently deletes your account and every vault you own from that server. If you can't sign in, ask the person who runs your PassAuth server to delete the account from its admin page. To remove PassAuth's data from a single device, log out in the app or uninstall it.

Children

PassAuth is not directed at children under 13 and does not knowingly collect their data.

Changes

If this policy changes, the new version will be published on this page with a new date.

Contact

Questions about this policy: see Support. Questions about the data on a particular PassAuth server go to whoever runs that server.