Start your 7-day free trial, card not charged until it ends
Browse all topics

Credentials vault

Agency & CRM · Last updated 16 July 2026

Every client site comes with a pile of logins: the hosting control panel, the CMS admin, the registrar, the FTP account, the mailbox. The credentials vault is a single, encrypted place to keep them, organised per client, so the whole team can get in without passwords living in a spreadsheet or a chat message.

What it is

A secure store for the usernames, passwords, URLs and notes your agency needs to log in to a client's services. Each entry is encrypted at rest and only visible to your team, and revealing a password is logged.
Read more
An entry holds a label, a category, an optional username, an optional URL to log in at, the password, and free-text notes. The password and the notes are the sensitive parts, so they are the parts that get encrypted. You can link an entry to a specific client and site, so it files itself alongside the rest of that client's work.

Why it matters

Agency passwords tend to end up in the worst possible places: a shared spreadsheet, a pinned message, someone's personal notes app. Any of those is one leak away from a client incident. A proper vault keeps them encrypted and accountable instead.
Read more
When a site goes down at 6pm, the last thing you want is to be hunting for the hosting login in an old email. Keeping credentials in one organised, searchable place, tied to the client and site they belong to, turns "who has the cPanel password" into a two-second lookup, and keeps that lookup off insecure channels.

What an entry holds

Each credential is deliberately simple. When you add one you set:

  • Label (required). A clear name so you know what it is at a glance, for example "cPanel - example.com".
  • Category. One of registrar, hosting, dns, ftp, cms, email, database or other. The vault groups and filters by this.
  • Username (optional). The login name for the service.
  • URL (optional). Where you log in, so you can jump straight there.
  • Password. The secret itself. This is encrypted before it is stored.
  • Notes (optional). Anything extra: a second factor recovery hint, a support PIN, account numbers. These are encrypted too, because they are often just as sensitive as the password.
  • Client and site links (optional). Attach the entry to a client and a website so it sits with that client's other records and can be filtered to.

How the encryption works

The password and notes fields are encrypted at rest using your organisation's own key. TLDTrack uses AWS KMS envelope encryption: a master key held in AWS KMS, never stored on our servers, wraps a per-organisation data key, and that data key encrypts your secrets. The stored value is ciphertext, not the plain password.

In practice this means two things. The everyday fields (label, category, username, URL) are stored normally so the vault stays fast to browse and filter, and the genuinely secret fields are held encrypted so a look at the raw database does not hand over your clients' passwords.

Why only the password and notes are encrypted

Labels, usernames and URLs need to be searchable and shown in the list for the vault to be usable at all, and on their own they are not enough to log in. The password and the notes are the parts that would actually let someone in, so those are the parts kept encrypted.

Revealing a password

A stored password is not shown until you ask for it. When you reveal an entry, TLDTrack decrypts it on demand and shows you the password and any notes. Two things happen at the same time:

  • A security audit event is recorded, noting who revealed which credential and when.
  • The entry's "last revealed" timestamp and the person who revealed it are updated, so there is a visible trail of access.

That trail is the point. In a shared spreadsheet nobody knows who looked at what; here, every reveal leaves a record.

Who can see them

Credentials belong to your organisation and are only visible to your team. They are scoped to your organisation throughout, so one agency can never see another's vault. Adding, editing and deleting entries follow your team's normal permissions, so members without write access can be kept to viewing rather than changing them. There is no restore button, so a deleted entry is gone from the vault.

Updating without re-typing the password

When you edit an entry, leave the password field empty to keep the existing password. Only type in the password box when you actually want to change it. The same applies to the encrypted notes.

Keeping the vault tidy

A vault is only useful if you can find things in it. Two habits keep it fast:

  • Link each entry to its client and site. Then you can filter the vault down to one client when you sit down to work on them, and the credential sits with their other records.
  • Use the category consistently. Filing hosting logins as hosting and registrar logins as registrar means you can jump to all the hosting accounts across your book in one filter.

Adding your first credential

  1. 1
    Open the credentials vault from your agency workspace.
  2. 2
    Choose to add a credential and give it a clear label, for example "WordPress admin - example.com".
  3. 3
    Pick a category, then fill in the username, login URL, password and any notes you need.
  4. 4
    Optionally link it to the client and website it belongs to, so it files itself alongside their other records.
  5. 5
    Save. The password and notes are encrypted immediately, and from then on revealing them is logged.

The vault protects storage, not sharing

The vault keeps your secrets encrypted and access accountable, but it cannot control what happens after a password leaves it. If you reveal a password and paste it into a chat, that copy is no longer protected. Reveal only when you need to, and avoid re-copying secrets into insecure places.

Where to set this up

In the app
Agency workspace

Open the credentials vault.

 Learn more
Agency CRM

A deeper overview.

Good to know

  • Passwords and notes are encrypted with your organisation's key; labels, usernames and URLs are not, so keep genuinely secret material in the password or notes fields.
  • Every reveal is logged with who and when, so access is auditable.
  • There is no restore button for a deleted entry, so delete with care.
  • Link entries to clients and sites to make the vault searchable as your book of business grows.
  • The vault is part of the Agency CRM. It is included on the Agency plan and is a paid add-on on Starter and Pro.
Available on:ProAgency

Was this guide helpful?

If anything is unclear or missing, tell us and we will improve it.

Contact support

Related guides

Clients

Organise your work by the client it belongs to.

Contacts & runbook

Who to call and what to do when a site goes down.

Team members & user roles

Invite your team and control who can see and change what.