SSH keys · API credentials · SAML SSO · Audit trail

Password Manager
for IT Teams

IT teams manage more than website logins — SSH keys, API credentials, service accounts, database passwords. SealedKeys has dedicated types for each, with team vaults, SSO and a full audit trail built in.

The IT credential problems SealedKeys solves

What IT teams actually do — and what to do instead.

SSH private keys in ~/.ssh with no access control
Encrypted SSH key type — stored in vault, shared only with authorised team members
API keys in .env files committed to version control
Typed API key fields with environment tagging and team-level access control
Service account passwords in a shared spreadsheet
Audited team vault — every access logged, instant revocation on staff changes
MFA recovery codes on a Post-it note
Encrypted recovery code type — always accessible, never visible to unauthorised users
No record of who rotated the production database password
Full audit log — every edit and deletion recorded with user, IP and timestamp
Contractor leaves; don't know which creds to rotate
Offboarding checklist — SealedKeys lists every secret the departing member accessed

Features built for IT teams

Not a consumer password manager with team features bolted on.

SSH key storage

Dedicated field type for SSH private keys — not shoehorned into a notes field. Store, share and audit access to private keys without ever distributing the file directly.

API credential management

Named, typed API key fields with environment labels (production, staging, dev) and service name. Find the right credential instantly; audit who accessed it last.

Service account credentials

Keep service account passwords, database connection strings and internal tool credentials in encrypted team vaults — separate from personal vaults.

Full audit trail

Every view, copy, edit and deletion logged with timestamp, user and IP. Know exactly when the production API key was last accessed and by whom.

SAML 2.0 SSO

Integrate with Okta, Entra ID or Google Workspace. Deprovisioning in your IdP immediately revokes SealedKeys access — no separate offboarding step.

Zero-knowledge encryption

Secrets encrypted client-side with AES-256-GCM before they leave the browser. The SealedKeys server cannot read your credentials — even with full database access.

Frequently asked questions

Can IT teams store SSH private keys in SealedKeys?+

Yes. SealedKeys has a dedicated SSH key secret type with purpose-built fields — not a workaround via secure notes. Paste the private key, set a description and environment, assign to a team vault, and share access with the appropriate engineers. Every access is logged.

How does SealedKeys handle API key rotation?+

When an API key is rotated, update the value in SealedKeys and the change is immediately reflected for all authorised team members. The audit log records who made the change and when. Secret rotation reminders are on the Pro roadmap.

Can we separate credentials for different environments (prod vs dev)?+

Yes. Create separate vaults for production, staging and development environments, or use the notes field to tag environment on individual items. Access control at the vault level means only the right engineers have access to production credentials.

Is SealedKeys suitable for storing service account passwords?+

Yes. Service account credentials, database connection strings, internal tool logins and any shared team credentials fit well in SealedKeys' team vaults. Role-based access control ensures only authorised team members can view or edit each vault.

How does SealedKeys handle IT offboarding?+

Remove the departing team member in Settings → Members — access is revoked immediately. SealedKeys provides an offboarding checklist listing every secret they had access to, so you can identify exactly what needs to be rotated without guessing.

Does SealedKeys integrate with our existing identity provider?+

Yes. SealedKeys supports SAML 2.0 SSO with Okta, Microsoft Entra ID (formerly Azure AD) and Google Workspace. Configure your IdP once in Settings → SSO; team members then sign in with their corporate credentials. Zero-knowledge is preserved — the IdP handles authentication only.

Related

Give your IT team a proper credentials vault

25 items free. No credit card. Takes 2 minutes to set up.