There is no console anyone can look into
No admin panel, no organisation, no seat management. Nobody at zenproducts and nobody at your company can open your vault, because the key is derived from a master password we never receive.
Skip to content
Explore apps 
Zen Passwords Zen Passwords Zen Teleprompter Zen Teleprompter
Explore apps Zen Passwords · reviewed
A personal password manager for your work logins
Plenty of people at companies use Zen Passwords for their work logins, and the reason is usually the same: it is theirs. One person, their own devices, no console anybody else signs into. That is a different thing from a corporate password manager, and it suits a different situation.
the situation
Why work credentials end up somewhere bad
This happens in well run companies as much as badly run ones. It is a gap, not a failure.
- The company does not provide a manager, so everyone quietly invents their own system.
- The company does provide one, but only for company systems, and the half of your working life that sits outside it has nowhere to go.
- You are a contractor with four clients and four sets of credentials, none of which belong together.
- You keep a second factor on a personal phone anyway, so the boundary was never as clean as the policy assumed.
- You leave, and nobody is sure which accounts were yours and which were the company’s.
why this one
What a personal vault does differently at work
This is a description of what the app does, not advice about your employment.
It holds the things a corporate manager will not
Your own payroll login, your health cover, the card you expense on, your professional registrations. These are yours, they are work adjacent, and they do not belong in a company system.
One-time codes in the same place
The authenticator lives in the vault, so a work login that needs a code does not depend on a second app on a phone you may or may not be carrying.
It leaves cleanly
When you move on, your vault moves with you and nothing of yours stays behind on a company system. There is nothing for anyone to deprovision, because there was never a seat.
Nothing crosses a network you do not control
The vault is on the device. Sync, if you turn it on, rides your own iCloud under your own Apple ID rather than any company infrastructure.
Five items free
Enough to put the handful of logins you actually use daily in and find out whether the AutoFill works in your company’s single sign-on before deciding anything.
Be honest with yourself
Where this is the wrong answer, and one of these is not about features
A personal vault at work has a boundary, and being clear about it is more useful than pretending it does not exist.
- Your company mandates a specific password manager. Use theirs for company credentials. That is a policy question and no feature list overrides it.
- Company credentials often belong to the company rather than to you, and storing them somewhere IT cannot reach may breach a policy you signed. Check before you migrate anything.
- You need to hand a login to a colleague. There are no shared vaults here, no team plan and no admin console, and there is no version of this that does that.
- Your employer needs to recover access when you are unavailable. A vault nobody else can open is the wrong place for anything the business depends on.
- You work on Windows or Android as well. This is Apple only.
The clean version of this is a personal vault for the things that are genuinely yours, alongside whatever the company runs for the things that are genuinely theirs.
how to start
Drawing the line in twenty minutes
The work is deciding what belongs to you, not moving passwords about.
Separate yours from theirs first
Payroll, benefits, your professional bodies, anything you would keep after leaving: yours. The production console and the shared inbox: theirs. Only the first list belongs here.
Check the policy before you move anything
Some employers require company credentials to live in a company system. This takes one message to ask and saves a genuinely awkward conversation later.
Start with the accounts that follow you
The ones tied to you as a person rather than to the role. They are the ones that cause the most trouble when you change jobs and lose the company login.
Move your own second factors over
For personal accounts only. Company second factors usually belong in whatever the company manages, for the same reason the passwords do.
Turn sync on if you use more than one device
Through your own Apple ID. If your work Mac is managed by the company, think about whether you want your personal vault on it at all.
questions
Zen Passwords for this
Can my employer see what is in my vault?
No. There is no admin console and no organisation account. The key that decrypts the vault is derived from a master password we never receive, so nobody at your company or at zenproducts can read it.
Can my company buy this for the whole team?
Not as a managed deployment. There is no admin console, no seat management and no shared vaults. Everyone would have their own separate personal vault, which suits some organisations and is the wrong shape for others.
Should I put company passwords in a personal vault?
That depends on your employer, not on the app. Many companies require credentials for company systems to live in a company managed tool. Worth asking before you migrate rather than after.
What happens to my work logins when I leave?
Anything in your vault stays with you, because the vault is on your devices. That is why the useful split is personal accounts here and company accounts wherever the company keeps them.
Try it
Zen Passwords
Your own work logins, in a vault with no console for anyone to look into.
other situationsBuilt for
Built for
a job, not everyone.
Freelancers and solo consultants
Client logins and your own business details, on your devices, with nothing shared.
Read itPeople who travel a lot
Passports, cards and codes in a vault that opens in aeroplane mode.
Read itYouTubers and video creators
Mirrored glass mode, front camera takes, and no watermark on the way out.
Read itConference and keynote speakers
Know the runtime before you walk on, and keep the talk off a server.
Read it