Deployment overview
Deploy a self-hosted password manager on Windows Server
One MSI installs the service and the browser application on your own server. Your team publishes it over HTTPS at the server’s IP address or DNS name and owns its certificates, backups, and updates.
Plan the server, the address, and the browsers
You need a supported Windows Server, administrator rights for the MSI, and a planned DNS name or IP address. Users need a browser with Web Crypto.
Read the HTTPS certificate guide
Install, then publish over HTTPS
Run the MSI as Administrator. After installation the server serves managed self-signed HTTPS until you configure a trusted PFX or P12 certificate.
Read the install and first-run guideQuick Recovery and the full backup do different jobs
Quick Recovery is a browser-encrypted package of profile data and accessible records without files. The Backup Tool captures the whole server. Neither replaces the other.
- A separate Quick Recovery key generated in the browser
- The Backup Tool ZIP is not password-protected on its own
- A Backup Tool manifest is required for database archives
- A restore closes every active session
Verify every update before you install it
Version, Ed25519 manifest signature, file hash, file size, and the allowed download host are checked on one path. The v3.0.3 MSI is unsigned, so trust comes from the manifest signature and the file hash.
- Update Center shows version, notes, package status, and checksum
- Restart the service and check the console version after install
- Extension updates come from the Chrome Web Store, not Update Center
Optional: the directory agent near the domain controller
The DC Agent is a Windows service on a host close to the domain controller, installed from an Administrator PowerShell session. It sends OU, group, and user metadata. The AD bind password is typed at its local prompt and stays on that host.
Read the directory agent guide