Is Passwork Self-Hosted safe?
Passwork Self-Hosted fills and saves credentials on every site, syncing them with the Passwork server you configure.
This is the browser client for a self-hosted Passwork password manager. It runs content scripts on all pages (including iframes) to detect login forms, autofill saved passwords, and capture new credentials, sending and retrieving vault data over your own configured Passwork server rather than a vendor-operated cloud. Credentials are stored locally encrypted with AES-GCM on Chrome; one low-severity finding notes that on Safari-identified browsers this at-rest encryption is skipped and the master password, API token, and session token are written in plaintext to extension storage.
Who publishes itPasswork - 1 other listing from the same operator, none carrying a finding
Passwork - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 7k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Passwork Self-Hosted contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- Your self-hosted Passwork server (user-configured host)
Passwork Self-Hosted sends data to Your self-hosted Passwork server (user-configured host). Named as a recipient in this extension's own analysis.