Passman is a full-featured, open-source password manager that runs as an app inside Nextcloud, for individuals and teams who already self-host Nextcloud and want their credentials to stay on infrastructure they control.

What it is

Passman is a password manager delivered as a Nextcloud application rather than as a standalone service, so it lives in the same instance that already holds a user's files, calendars and contacts. It is licensed AGPL-3.0, developed in the nextcloud/passman repository, and has its homepage at passman.cc. Credentials are organised into multiple vaults, and vault keys are never sent to the server; credentials themselves are encrypted with 256-bit AES. Storage goes through the Nextcloud database layer, with SQLite, MySQL/MariaDB and PostgreSQL all supported and each exercised by PHPUnit continuous integration on GitHub Actions.

The problem it solves is the split that opens up when a self-hosted Nextcloud installation is used for everything except passwords, pushing users back to a third-party hosted password manager or a spreadsheet. Passman keeps credential storage inside the instance the administrator already operates and backs up, while retaining the reach of a conventional manager through a browser extension for Chrome and Firefox and a native Android app. For anyone already storing passwords elsewhere, the README provides import paths from KeePass, LastPass, DashLane, ZOHO, Clipperz.is, EnPass and ocPasswords, though it labels those importers experimental.

Key capabilities

• Multiple vaults, with user-defined custom credential fields for entries that do not fit a fixed schema.
• 256-bit AES-encrypted credentials, with vault keys that are never sent to the server.
• A built-in OTP (one-time password) generator alongside a password analyzer.
• Secure sharing of passwords internally and with others via link.
• Import from KeePass, LastPass, DashLane, ZOHO, Clipperz.is, EnPass and ocPasswords, marked experimental.
• Database compatibility with SQLite, MySQL/MariaDB and PostgreSQL, with PHPUnit CI run against all three on GitHub Actions.
• Companion clients: the rewritten Passman Webextension for Chrome and Firefox, and the native Passman Android app.

Who uses it and how

• Nextcloud administrators who already run their own instance and want credentials stored alongside files, calendars and contacts rather than in a separate service.
• Individuals migrating from KeePass, LastPass, DashLane, ZOHO, Clipperz.is, EnPass or ocPasswords, using the built-in importers as a first step.
• Small teams that share credentials with colleagues internally or with outsiders through a link, without leaving the Nextcloud instance.
• Day-to-day users who work in the browser through the Passman Webextension and on the phone through the Passman Android app, distributed via Google Play, IzzyOnDroid and F-Droid.
• Evaluators and contributors: a hosted demo is available, the project carries the hacktoberfest topic, and discussion runs through the "Passman General Talk" Telegram group.

Getting started

Install Passman as a Nextcloud app from the Nextcloud App Store, which is the distribution channel the README points to. A hosted demo instance is available if the app needs to be evaluated before anything is installed.

How it compares

The README does not set Passman against commercial products directly; it names KeePass, LastPass, DashLane, ZOHO, Clipperz.is, EnPass and ocPasswords as sources it can import from, which positions Passman as a migration destination for each of them. Its distinguishing characteristic among those tools is that it is not a standalone product at all: it is bound to Nextcloud, so credentials sit in the same AGPL-3.0 self-hosted instance as the rest of the user's data.

When to use it — and when not to

Choose Passman if a Nextcloud instance is already in place, because a self-hoster must operate that server plus one of the supported databases — SQLite, MySQL/MariaDB or PostgreSQL — and take responsibility for its backups and updates. It is a poor fit for anyone who does not run Nextcloud or who wants a password manager with no infrastructure to look after. The importer set is explicitly experimental, and the repository carries 101 open issues against 823 stars and 118 forks, so prospective users should satisfy themselves that upstream activity and issue handling match their expectations.

docker run -d -p 8080:80 -p 8443:443 \
  -v /path/to/passman:/var/www/html/apps/passman \
  --name passman-dev \
  binsky/passman-dev:latest