VaultPilot Enterprise Vault Console is a self-hosted, zero-knowledge enterprise vault console installed on Windows Server with an MSI. Users open it over HTTPS in a browser through the server IP address or DNS name. Creating the first profile and unlocking a vault work only over HTTPS; the server provides managed self-signed HTTPS until a trusted PFX/P12 certificate is configured.
PassMan is the product’s earlier name; upgraded servers may still show it in a few compatibility names.
Principles
- The master password is not sent to the server.
- Vault keys are unlocked in browser-session memory.
- Secret payloads are encrypted in the browser before they are saved.
- The server stores only encrypted data, wrapped keys, and operational metadata in a local database.
- Update packages are verified with a signed manifest and SHA-256 hashes.
Components
| Component | Purpose |
|---|---|
| VaultPilot Server | Main Windows service and browser application. |
| Chromium Extension | Autofill, save/update login prompts, and active-site badge counts. |
| Offline Share Decrypter | Opens external share packages fully in the browser. |
| VaultPilot DC Agent Service | Synchronizes Active Directory metadata into VaultPilot. |
Start here
- Windows Server installation
- First run, owner and license
- Public host, HTTPS and certificates
- Server System settings
- Update Center
- Troubleshooting
In-app documentation button
The top bar has a help button with a question-mark icon. It opens the documentation page for the current screen in the console language.