Team vault
Shared passwords, API keys and notes with a generator, one-tap copy and search. Each item is sealed with AES-256-GCM and bound to its slot, so ciphertext can't be swapped between items.
~ private team workspace
Passwords, files and code the server can't read
Workspace gives your team an encrypted password vault, encrypted file storage with share links, and its own Git organization. Everything is encrypted in your browser before it's uploaded.
- No sign-up for the demo
- Keys never leave your browser
- One SudoSecurity sign-in
- Built for phones first
what your team sees
Cloudflare (production)
Usernameops@acme.example
Password••••••••••••••••
what the server stores
~ features
One private place for what your team can't afford to leak
The tools teams already use for credentials, documents and code, built on top of encryption instead of next to it.
Encrypted files
Every file gets its own random key. File names and types are encrypted too, so the server only sees a size and a date.
Share links
Send a file to anyone, with or without an account. The key lives after the # in the link, which browsers never send to us. Links expire and stop after a set number of downloads.
Roles & key rotation
Owner, admin and member roles. Admins confirm a safety code before granting access, and removing someone rotates the team key in one step.
Git built in
Each team gets an organization on git.sudosecurity.org, with members and roles kept in sync automatically.
Activity log
See who added, changed, shared or deleted what, and when. Sign-in uses your SudoSecurity account, so there's one identity across every service.
~ encryption
How the encryption works
Encryption happens in your browser with the Web Crypto API. Our servers store ciphertext and never hold a key that opens it.
-
You get a key pair
Your browser creates an ECDH P-256 key pair. The private half is locked with your passphrase (PBKDF2, 600,000 rounds) before a backup is stored, so we can't open it.
-
Your team shares a team key
A random AES-256-GCM team key is wrapped separately for each member. Admins compare a safety code before granting access, so a swapped key can't slip in.
-
Everything is sealed before upload
Vault items, file contents and file names are encrypted on your device. Removing a member rotates the team key and re-seals the vault for everyone who stays.
What we can still see: who is in which team, file sizes, and when things change. That metadata lets us enforce roles, storage limits and share-link expiry. The content stays sealed.
~ faq
Questions
What is Workspace?
Workspace is SudoSecurity's private team suite: an end-to-end encrypted password vault, encrypted file storage with share links, and a Git organization for every team, all under one SudoSecurity sign-in.
Can SudoSecurity read our vault or files?
No. Everything is encrypted in each member's browser with keys we never receive. We can see who is in a team, file sizes and when things change, but not what's inside.
What's in the live demo?
A sample team called Acme Security with vault items, files, a share link and two teammates. The encryption is real and runs in your browser. Invites, Git and large uploads are off in the demo, and it deletes itself after 2 hours.
What if I forget my passphrase?
We can't recover it, by design. You can create new keys, and a team admin grants you access again.
Does it work on phones?
Yes. Workspace is designed for phones first and works in any modern browser.
See it with your own eyes
Open the live demo: a sample team with real encryption, ready in seconds. No account needed.