# Team passwords

> Store in Ironchip the passwords that people do need to know, share them with people or groups, and see who revealed each one and when they did it.

URL: https://docs.ironchip.com/en/pam/boveda/contrasenas/

This page explains how to store and share passwords that people do need to know, such as the router password at a site, the password for a vendor portal or the password for the Microsoft 365 emergency account. It is for anyone in the admin console of a company with PAM.

The passwords Ironchip keeps for itself (those of the machines, the workload secrets and the cloud credentials) never appear here: the broker and the workloads use them without anyone seeing them.

## How it works

- Each password has an **owner**: whoever stores it. Only the owner can change it, share it, delete it or view its record.
- The owner shares it with **people** or **groups**. They can reveal it, not change it.
- The password and the notes are stored encrypted in the company's secret store, not in the platform's database.
- **Every time someone reveals it, it is recorded**, with who did it and from which address. The record is kept for one year.

## Store a password

1. Go to **PAM > Passwords** and click **Keep a password**.

   [Image: Passwords page with the list of passwords, who keeps them and who they are shared with]

2. Fill in **Name** (for example, `Site router`) and, if you want, **Username (optional)** and **Address (optional)**, which starts with `http://` or `https://`.
3. Enter the password in **Password**, or click **Make one** to have Ironchip generate one with the [company's complexity](https://docs.ironchip.com/en/pam/boveda/rotacion/#password-complexity).
4. Add **Notes (optional)** if needed.
5. Click **Keep it**.

## Share it

1. In the password's row, open **Options > Share**.
2. In **Search people and groups**, search for and select the people and groups that will be able to reveal it.
3. Click **Save**.

To stop sharing it, clear the person or group. Group membership is checked every time someone reveals the password: whoever leaves the group stops seeing it.

## Reveal it

1. Click **Reveal** in its row.
2. Use **Show** to see it or **Copy** to copy it to the clipboard.

If another person shared it with you, that person sees in the record every time you reveal it.

## View the record

Open **Options > Record**. It shows every time the password was stored, changed, shared, revealed or deleted, with the person and, when it was revealed or deleted, the address it was done from.

## Change or delete it

- **Options > Edit** changes the name, the address, the username, the password or the notes. Leave **New password (leave empty to keep it)** empty to keep the current one.
- **Options > Remove** deletes it for you and for everyone it is shared with. It cannot be undone.

## Limits

| Field                | Limit                  |
| -------------------- | ---------------------- |
| Name                 | 128 characters         |
| Username             | 256 characters         |
| Address              | 2048 characters        |
| Password             | 4 KiB                  |
| Notes                | 8 KiB                  |
| People to share with | 100                    |
| Groups to share with | 50 (collective groups) |

## More information

- [Credential vault](https://docs.ironchip.com/en/pam/conceptos/boveda/)
- [Checkouts and break-glass](https://docs.ironchip.com/en/pam/boveda/checkouts/): the passwords of the machines that Ironchip manages.