All featuresSovereign workplace

Company password manager

Team passwords live in a private Git repository, managed with pass, the open-source password manager from passwordstore.org. Each password is its own GPG-encrypted file, and a YubiKey unlocks it. This is how Obmondo stores passwords and other credentials when they are needed.

A terminal running pass: the password store as a tree of folders and entries, one entry shown with a fake password, and the three latest Git commits of the store.
pass (passwordstore.org) in a terminal

Screenshots are taken from the apps running on a test server, with made-up data.

What stays in your control

  • Each password is its own GPG-encrypted file in a private Git repository on Gitea. No vendor cloud holds the secrets.

  • Each password needs its own YubiKey touch and an 8-digit PIN. There is no master unlock for all secrets.

  • Access is granted per person. Having the repository alone does not give access to the secrets.

  • Whenever possible, Obmondo avoids passwords altogether and uses Keycloak or hardware-based login instead.

Open-source apps behind it

  • pass (passwordstore.org)
  • GnuPG
  • Gitea

Alternative to

Hosted password managers, for teams that already work with GPG and Git

How sovereign is your setup?

Score this feature and the rest of your stack in the free assessment.

Take the assessment