PassWeb

Free plan Self-hostedWeb

What PassWeb is

PassWeb is a free, open-source web application for managing passwords online and offline. It keeps account data encrypted so decryption occurs only on the client; the server does not receive usernames, passwords, or other unencrypted data. PassWeb uses 256-bit AES in CBC mode, with a key derived through PBKDF2 using SHA-512 and 1,000 iterations. Users can cache encrypted passwords for offline access and synchronize changes when online. The app can generate random complex passwords, copy stored names and passwords, and save notes. It logs users out after three minutes of inactivity and re-masks revealed credentials after ten seconds. The client can run on a web or file server, with storage APIs for ASP.NET and Node.js; Node.js can store data as Microsoft Azure blobs. An administrator creates accounts after requests. Forgetting the master password permanently loses encrypted data. The author recommends HTTPS and avoiding untrusted devices.

Who it suits

PassWeb suits people or organizations wanting a self-hosted, browser-based password store with client-side decryption and offline access. It is intended for normal use in low-risk environments, subject to each user’s risk assessment.

What it does well

Free and open source
Client-side decryption keeps plaintext off server
Offline password access with synchronization
Generates random complex passwords
Supports ASP.NET and Node.js storage APIs

What to know first

Forgotten master passwords cannot be recovered
Administrator must create each account
Author recommends use only in low-risk environments
Requires HTTPS for API and client files

Verdict

PassWeb focuses on client-side privacy, self-hosting, and offline password access without a paid plan. Its recovery limitation and administrator-managed accounts require careful operational planning before deployment.

Facts from PassWeb's own pages

Account recovery limit: The README says forgetting the master password means the encrypted data is irretrievably lost because there are no backdoors or secondary passwords. · github.com, 8 Oct 2026
Account setup: The README says users must contact the administrator to request an account, which is created with a temporary password. · github.com, 8 Oct 2026
Browser support: The README says PassWeb works on modern browsers, including recent Internet Explorer, Chrome, Firefox, and Safari releases. · github.com, 8 Oct 2026
Client-side privacy: The README says data is decrypted only on the client and unencrypted data never leaves the machine. · github.com, 8 Oct 2026
Encryption: The account data file is encrypted with 256-bit AES in CBC mode, and the README says the encryption key uses PBKDF2 with SHA-512 and 1,000 iterations. · github.com, 8 Oct 2026
Hosting: The client can be hosted on any web server or file server, and the storage API has ASP.NET and Node.js implementations. · github.com, 8 Oct 2026
Intended use: The author says PassWeb was intended to be safe for normal use in low-risk environments and advises users to evaluate it for their own needs and risks. · github.com, 8 Oct 2026
Local encryption: Account data is decrypted only on the client; the server does not see the username, password, or unencrypted data. · github.com, 8 Oct 2026
Offline use: Users can cache encrypted passwords for offline access, and changes synchronize with the server when PassWeb is used online. · github.com, 8 Oct 2026
Password tools: Users can generate random complex passwords, copy or select stored names and passwords, and keep additional information in notes. · github.com, 8 Oct 2026
Purpose: PassWeb is an online/offline web application for securely managing passwords. · github.com, 8 Oct 2026
Recovery limit: The README says forgotten master-password data is irretrievably lost because there are no backdoors or secondary passwords. · github.com, 8 Oct 2026
Security guidance: The author recommends HTTPS for both the storage API and client files, and warns users to avoid entering their master password on untrusted devices. · github.com, 8 Oct 2026
Server implementations: The storage REST API implementations are provided for ASP.NET and Node.js. · github.com, 8 Oct 2026
Session protection: PassWeb logs users out after three minutes of inactivity and re-masks revealed names and passwords after ten seconds. · github.com, 8 Oct 2026
Storage: It stores encrypted password data in the cloud so it can be accessed from anywhere. · github.com, 8 Oct 2026
Storage options: The Node.js implementation supports storing data as blobs in Microsoft Azure. · github.com, 8 Oct 2026
Support: The author asks users to report problems and says browser issues should be emailed with detailed reproduction steps. · github.com, 8 Oct 2026
Supported platforms: web · github.com, 20 Sept 2026

Where PassWeb stands on Freedom251

Password Managers#76 of 104