Coauth: Team Password & Passkey Manager Chrome extension security report

A password and passkey manager built for teams, and it is zero-knowledge. Coauth saves your website logins, fills them in for you, generates strong passwords, and does the one thing nothing else does well: it lets you share a login (password or passkey) with a team, encrypted, so a shared account works for everyone without passing secrets around in chat. WHAT IT DOES • Save passwords as you log in, and autofill them on your next visit. Built-in strong password generator. • Create and use passkeys on any site that supports them. Coauth is a software authenticator, so its passkeys can be shared, unlike a fingerprint passkey locked to one device. • Share any login into a team. Teammates autofill the password or use the shared passkey from their own browser. No secret ever changes hands. • Manage it all in one popup: a unified vault of passwords and passkeys, teams, roles, invites, and an activity log. WHY IT IS DIFFERENT • Purpose-built for shared logins, with roles, email invites, and real revocation. Remove a member and the team key rotates, so their access actually ends. • Zero-knowledge. Your vault is locked with your device passkey plus a recovery key that only you hold. Everything is end-to-end encrypted with audited cryptography (libsodium) before it syncs. The server stores only ciphertext and can never read your passwords or passkeys, personal or shared. A backend breach exposes nothing usable. • Nothing to pass around. No exported password in a chat, no shared spreadsheet of logins. HOW IT WORKS 1. Sign in with Google, then secure your vault with this device's passkey. A one-time recovery key is your backup. 2. Log in on a site and Coauth offers to save it. Or add one manually with the generator. 3. On your next visit, click the Coauth suggestion to autofill. 4. Share a login into a team and teammates use it from their own browser. GOOD TO KNOW • Coauth can only share passkeys it created. A passkey already registered with your fingerprint or a security key cannot be exported (that is how passkeys work). Add a new one through Coauth to share it. • One passkey extension can be active at a time. Coauth has a one-click Pause to hand passkey control back to your device or another manager when you need it.