Skip to main content
Password Manager for Perfex CRM

Stop Keeping Client Passwords in Spreadsheets.

A full password manager inside Perfex CRM. Store every client credential per project with XChaCha20-Poly1305 encryption, share them safely with staff and clients, and get warned when a password shows up in a data breach.

Get the Module - $59
Lifetime Updates 9 Credential Types
Documentation
Try our Demo

Spreadsheets Are Not a Password Manager.

If you manage websites for clients, you know where the credentials end up: an Excel file, a note on someone's desktop, a ticket reply from 2021. One breach and everything is exposed. This module gives every project its own encrypted vault, right inside the CRM your team already works in.
Project passwords in Perfex CRM

Encryption That Holds Up

Every credential field is encrypted with XChaCha20-Poly1305 via libsodium before it touches the database. No plaintext is ever stored, and the encryption key never sits next to your data.

  • Encrypted at Rest: Each field gets its own unique nonce. The database only ever holds ciphertext.
  • Key Outside the Webroot: The encryption key is stored one level above your webroot, unreachable over HTTP.
  • Key Rotation Built In: Re-encrypt your entire vault with a fresh key in one atomic transaction.
  • Full Audit Trail: Every view, edit, export and delete is logged with staff member, IP and source. Exportable as CSV.

One Vault per Project

Credentials live where the work happens: on the project. Nine dedicated credential types, each with its own fields: CMS, hosting, control panel, FTP, database, email, mailboxes, SSH and a free-form type for everything else. Open a project, and everything your team needs is right there.

Breach Monitoring

Every stored password is checked against the Have I Been Pwned database using k-anonymity: only the first 5 characters of a SHA-1 hash ever leave your server. Breached credentials are flagged and rechecked via cron.

Generator, Duplicates & Expiry

Generate strong passwords with configurable length and character sets, spot reused credentials with hash-based duplicate detection, and get expiry warnings before certificates and passwords go stale.

Nine credential types per project
Passwords tab in the client portal

Share With Clients, Not via Email

Clients get a Passwords tab in the portal they already use. You decide per credential, or per project, what they can see. No more "can you resend the FTP login" tickets.

  • Client Portal Sharing: Share single credentials or a whole project. Clients see exactly what you share, nothing else.
  • Per-Staff Permissions: View, create, edit and delete rights per staff member, with per-project overrides.
  • Controlled Reveals: Staff re-authenticate before decrypting, decrypt requests are rate limited, and the clipboard auto-clears.
  • PDF & FileZilla Export: Hand over credentials as a clean PDF or an import-ready FileZilla XML file.
  • Email Notifications: Breach alerts, expiry warnings and share notifications via editable Perfex email templates with merge fields.

Get Your Credentials Under Control.

One license, one encrypted vault for every project in your Perfex CRM.

Module License

$59
  • Unlimited Projects
  • Unlimited Credentials
  • Lifetime Free Updates
  • 6 Months Support included
BUY NOW
Instant Download Easy Installation

Frequently Asked Questions

How are my passwords encrypted?

Every credential field is individually encrypted with XChaCha20-Poly1305 (an authenticated encryption algorithm) via PHP's native libsodium bindings, each with its own random nonce. The database only ever contains ciphertext. No plaintext password is ever stored or logged.

Where is the encryption key stored?

The key is generated automatically on activation and stored in a PHP file one level above your webroot, so it can never be downloaded over HTTP. Someone who steals your database gets nothing but ciphertext. Do back up the key file: without it, your vault is unrecoverable by design.

Can Cloudmill read my passwords?

No. Everything runs on your own server: encryption, decryption and the key itself. The module never sends credentials to Cloudmill or any third party. The only outbound call is the optional breach check, which sends 5 anonymous hash characters to Have I Been Pwned.

Does the breach check send my passwords to Have I Been Pwned?

No. The check uses k-anonymity: only the first 5 characters of a SHA-1 hash are sent to the Have I Been Pwned API. The API returns a list of hash suffixes and the matching happens on your server. Your actual password never leaves your installation.

What stops a staff member from dumping the whole vault?

Several layers. Staff must re-enter their password before they can decrypt anything, decrypt requests are rate limited per staff member and IP, access is scoped per project with view/create/edit/delete permissions, and every reveal is written to a tamper-evident audit log with IP address.

Can my clients see their passwords?

Yes, if you want them to. You can share individual credentials or a whole project to the client portal. Clients see a Passwords tab on their project with exactly what you shared, nothing more. Sharing is off by default.

Can I rotate the encryption key later?

Yes. The built-in key rotation generates a fresh key, decrypts and re-encrypts your entire vault in a single database transaction, and writes the new key file atomically. If anything fails halfway, everything rolls back and the old key stays active.

What are the server requirements?

PHP 7.4 or higher with the sodium extension (enabled by default since PHP 7.2), Perfex CRM 3.x and MySQL/MariaDB. For PDF export you optionally need mPDF or TCPDF. That's it.

Can I test the module in the demo?

Yes! The Cloudmill Showroom is designed to show how our modules work together. You can switch between different Cloudmill extensions directly from the sidebar menu.

Is this a one-time purchase?

Yes, once you purchase the module via CodeCanyon, you own the license for your Perfex CRM instance. All future updates for that version are included.

Do you provide support for installation?

Definitely. If you run into any issues during installation or configuration, you can reach out to us at Dit e-mailadres wordt beveiligd tegen spambots. JavaScript dient ingeschakeld te zijn om het te bekijken..

Still have questions? Contact me!