maxsuite Diagrams

Passwords

Passwords

Passwords (MaxPass) is one place for every login and credential: website logins, mailboxes, servers, API keys and secure notes (module maxpass). Agents can use a login without ever seeing it. Every login is private to its owner until they share it.

In the sidebar under Connections → Passwords.

Passwords

The screen has four tabs: Passwords, Trash, Activity and Settings.

Passwords

Every login you own or that was shared with you, with its name, kind, site and username. Badges say Shared, Shared with you, Not shared, No password yet or Asks every time. Filter by Every kind or one Kind, and search by name, username, site or tags.

Open a login to see its Details, History and Sharing. From there you can:

  • Show or Hide the password, and Copy it. Showing needs the Show level on that login and a fresh sign-in. A copied password is taken off the clipboard after a while.
  • Use it: when you were given the use level, Max uses it for you, and you never see it ("You can use it, not see it").
  • See its Strength, Who can see it, what it is Linked to, and who it was Made by.
  • Change it, Make a password, or Put in trash.
  • Link it to a domain, a mailbox, a project, a server or a site, and Copy link to the login.

Add a login

Press Add… or Add a login and choose its kind. Each kind asks for its own fields:

  • A website login: Username or email and Site addresses, one per line.
  • A mailbox: Email address, Incoming server (IMAP) and IMAP port, Outgoing server (SMTP) and SMTP port, and Webmail address.
  • A server: Host, SSH port, User, and a Password or Private key with its Key passphrase.
  • An API key: Service, Key ID, Console address, Key and Secret.
  • A secure Note for recovery codes, a PIN or answers to security questions.

Every login has a Name, Tags and Notes. Notes are plain text everybody who can see the login can read, so never put a password there. Ask to confirm: After a few minutes, as usual, or Every time it is shown, for a seed phrase or a bank login. Make a password makes a strong Password or Passphrase of the Length you choose.

Secrets are kept sealed. A private key is shown in the list only by its fingerprint. Each time a password changes, the old one is kept under History for a while.

Share a login

On Sharing, choose Share with a person, a team or an agent, and What they can do:

  • See: the login's name, site and username.
  • Use: have it used for them, never see it.
  • Show: see and copy the password.
  • Edit and Manage.

An agent can be given see or use, never show. Stop sharing takes it back.

Trash

Logins put in the trash. Tools stop using them. Put back or Restore brings one back.

Activity

Who added, changed, showed, copied or used a login. No password is ever written here.

Settings

MaxPass settings: Confirm again after (minutes), how long after signing in people can show and copy without typing their password again (1 to 60), and Clear copies after (seconds) (10 to 300).

Asking someone for a password

An agent, or you, can ask a person for a login's password privately. The question arrives in their private chat with the bot, where the reply is taken down and saved, or as a one-time form link when they have no chat. Passwords typed in chat are kept in MaxPass and removed from the chat. Questions nobody answers in time are closed.

Who can do what

PermissionLets you
maxpass:readSee the passwords and logins shared with you: names, sites and usernames. Showing a password also needs Show on it and a fresh sign-in.
maxpass:writeAdd, change and archive logins you can edit, ask a person for a password, and make new passwords.
maxpass:adminManage the Shared space, who reaches it, MaxPass settings and everybody's MaxPass activity.

Sharing is separate from permissions. See People, roles and permissions and Sharing and visibility.

What happens on its own

JobWhenWhat it does
expire-asksEvery 5 minutesCloses password questions nobody answered in time, so an old question does not sit in somebody's chat after its form stopped working.

Needs

Nothing has to be switched on first. Asking in chat uses a linked Telegram account from Comms.

What agents can do

An agent works with the logins it can reach: those the person it works for owns or was shared, and those shared with the agent. It never sees a password. It can have one used, for example to connect a mailbox in Mail. Reads run straight away. Changes wait for a person's approval by default. Sharing asks every time. See Agents and approvals.

Read only: maxpass.list, maxpass.search, maxpass.get, maxpass.health

Change, needs approval: maxpass.create, maxpass.update, maxpass.generate, maxpass.ask, maxpass.link, maxpass.archive

Always asks: maxpass.share

  • maxpass.search finds a saved login by words. Agents are told to use it before asking anybody for a login.
  • maxpass.get gives a login's non-secret fields and whether a value is saved. Never the value.
  • maxpass.create makes a login with no value yet. Give it a value with maxpass.ask (the person types it privately) or maxpass.generate (Max makes a strong one).
  • maxpass.update changes non-secret fields only.
  • maxpass.health says how strong a saved password is, from 0 (very weak) to 4 (very strong), without the password.
  • maxpass.archive puts a login in the trash.

Over MCP the same tools are named maxpass__list and so on. See API keys and MCP access.

Passwords · maxsuite · MaxDoc