Does anyone have good experiences with a password manager for a corporate environment? …

My current employer uses 1password and it has a couple of nifty features like "vaults" shared with a group of people, an "op run" command to inject secrets using a .env file, service accounts to fetch passwords in CI, etc.

Bitwarden is pretty usable, we use it at our org, and while still has a rough edge or two for corporate use, gets better all the time.

I have no practical experience yet, but i evaluated the market for a password sharing solution for a team with similar requirements within an enterprise. Another option in that area is https://www.passbolt.com/ It uses a public/private key approach, where the plain passwords never leave the local machine and shared passwords are re-encrypted with each users public key.

I think one could build something nice on top of FOKS ( https://foks.pub ).

My and my buddy have been using “pa” for our company with great success: https://git.j3s.sh/pa It uses age and allows you to use multiple keys for encryption

> As a company password manager, there is no way to know who's accessed which secret across their lifetime at the firm so you get to change all the passwords constantly. You can setup different directories to use different keys, and you don't need to limit yourself to a single key for each password either. You can use multiple. So you can setup structures like: - admins/.gpg-id "admin\n" - techs/.gpg-id "admin\ntech\n" where admin and tech are 2 keys for different groups of people. Admin having more access. Or even better: - site_foo/.gpg-id "bob\nalice\n" - site_bar/.gpg-id "bob\nrobert\n" where each employee has their own key. So you can fine-tune which passwords need changing if an employee leaves, and which passwords an individual employee needs to be able to access. You can setup git submodules to control which passwords which employees can know to exist. And given that git is being…