Chapter 31

The Credential Storage Manager (saved logins)

The Credential Storage Manager keeps the user names and passwords you use for work in one encrypted place inside TechieCRM: email accounts, your office database login, database servers, websites and anything else. Each saved login is locked with keys that only you, and the people you share it with, hold. TechieCRM's database, the TechieCRM cloud and your administrator keep locked copies only and cannot open a password.

In this chapter

Who can use it

The Credential Storage Manager is part of a TechieCRM cloud subscription for offices that keep their records in TechieCRM's MongoDB database. You also sign in with your TechieCRM ID, and TechieCRM's database must be reachable (on your computer or your office server).

Your office database login on a SQL sign-in (October 2026). One kind of saved login also works when your office keeps its records in the source CRM's SQL database: your own Office database login. When you sign in to SQL with your TechieCRM ID, the second window's Save in my Credential Storage Manager tick keeps your CRM password as an Office database login (encrypted, Personal, yours only), and the next time your TechieCRM ID is enough (Administrator Guide A3, Signing in to SQL with your TechieCRM ID). It still needs the cloud subscription, your TechieCRM ID and TechieCRM's database on this computer or your office server. On a SQL sign-in the rest of the manager stays closed (the button stays greyed with the reason below); you see and edit that saved login in the window the next time you sign in to Mongo, or remove it from the sign-in's second window with Forget the saved password.

When one of these is missing, the Credential Manager button on the ribbon is greyed and the reason shows when the pointer rests on it, or the window opens and says why:

You see What it means
"Credential Storage Manager needs a TechieCRM cloud subscription." Your licence has no cloud subscription in force.
"The Credential Storage Manager is available when your office keeps its records in TechieCRM's MongoDB database." You signed in to the source CRM's SQL database. (Your own Office database login still works from the sign-in window, above.)
"Sign in with your TechieCRM ID to use the Credential Storage Manager." You are not signed in with a TechieCRM ID on this computer.
"The Credential Storage Manager needs TechieCRM's database on this computer or your office server." TechieCRM's MongoDB database did not answer.

Opening it

Tools ▸ Security ▸ Credential Manager (the key icon). The window opens beside your work; you can keep it open, move it and resize it, and it remembers its size. Your office's local portal has the same button and the same manager as pages (see On the local portal); on techiecrm.com the button is greyed: "Available in the desktop app and the local portal."

The first time on a computer, TechieCRM opens your saved logins with the keys your sign-in left on this computer. You may instead see one of these:

Message What to do
"Enter your TechieCRM password to open your saved logins." Type your TechieCRM password in the box and choose Open.
"That is not the TechieCRM password your saved logins were locked with." Type it again carefully.
"This computer is waiting to be allowed by one of your other devices..." Allow this computer from one of your other signed-in devices (the same approval mail accounts use, chapter 12).
"Your password was reset, so your saved logins are waiting for an administrator to restore your access. Nothing else is needed from you." Nothing to type or remember: your computer has already asked; an administrator approves it.
"An administrator did not approve restoring your saved logins..." Talk to your administrator, then choose Ask again.
"...this office has no recovery key, so they cannot be opened..." Choose Start over (see If you forget your TechieCRM password).

The window

  • On the left, the login types with how many logins each has: All, Shared with me (logins someone else owns and shared with you), then each type you have logins of.
  • The search box finds logins by title, by site, and by user name.
  • The list shows each login's Title, Type, User name, Site, Owner ("You" for your own), Shared (how many people have it, and how many are still waiting) and Kept as (Business or Personal). A login shared with you that is still on its way says "Waiting for a computer to finish sharing": it opens once a computer of someone who has it is online.
  • The buttons: Add, Edit, Delete, Copy user name, Copy password, Open site, Share, Versions and New login type. A button is greyed when it does not apply to the selected login (for example Delete on a login you do not own).

Double-click a login to edit it.

Login types and their fields

Every login has a Title (required), Notes and Web addresses (one per line). Each type then has its own fields (the ones marked * are required):

Type Fields
Email account Email address *, Display name, Provider * (IMAP, POP, Microsoft, Google), Incoming server, port and security, User name, Password, Outgoing server, port and security, Outgoing user name and password (blank means the same as incoming), Shared mailbox. An IMAP or POP account needs both servers.
Office database login SQL Server instance , Database , Workspace ID, CRM user ID *, Password
Database server Database type * (SQL Server, MongoDB, PostgreSQL, MySQL, Other), Server *, Port, Database, User name, Password, Connection options
Website login at least one web address, User name, Password, the names of the page's user name and password fields, and "Press Sign in for me" (off)
Other login User name, Password
Your own types the fields you chose (see Making your own login type)

Passwords and other secrets are hidden (dots) until you choose Show.

Adding a login

  1. Choose Add. If a type is selected on the left, the new login starts as that type.
  2. Pick the Login type; the form changes to that type's fields.
  3. Fill in the fields. For a password, type it, or choose Generate for a new random 20-character password (letters, digits and symbols). Show reveals what you typed.
  4. Choose Business or Personal under Kept as (see Business or Personal).
  5. Choose Save. If something is wrong, the message under the form says which field, and the cursor goes to it.

Making your own login type

Choose New login type, give it a name (for example "Alarm panel"), and add its fields: a name, a kind (Text, Secret (hidden), Web address, Number or Choice, with the choices separated by commas), and whether it is required. Choose Create type. The new type appears in the Login type list when you add a login. Your types are yours; an administrator may tick Publish to the whole office so everyone can use the type.

Copying a user name or password

Select a login and choose Copy user name or Copy password. The value goes on your clipboard and the status line says "Password copied. It will be cleared in 30 seconds." After 30 seconds TechieCRM clears the clipboard, but only if it still holds that password: anything you copied since is left alone. Closing the window does not stop the clearing.

Every copy is recorded in the login's history (who, when, which computer), never the value.

Opening the site

For a login with a web address, Open site opens the first address in your web browser. Use Copy user name and Copy password to sign in there.

Editing, versions and roll back

Select a login and choose Edit (or double-click it). The owner and everyone the login is shared with may edit it. Every edit keeps the version before it, with who made it and when, so a password change that turns out to be wrong can be undone.

Choose Versions to see them, newest first. Select an earlier version and choose Roll back to this version; after you confirm, that version becomes the current one. The roll back is itself a new version, so it can be undone the same way. TechieCRM keeps the last 20 versions.

Sharing a login, and removing someone

Select a login and choose Share. The People tab lists everyone who has it: the Owner, people who Can use it, and people Waiting for their computer.

Add people (owner only): tick the people to share with and choose Share. The list holds the people of your office whose office login is linked to a TechieCRM ID. TechieCRM fetches their sharing key from the TechieCRM cloud, so the share is finished at once. Someone who has never opened the Credential Storage Manager is shown as waiting: the share finishes by itself the next time they, or a computer of someone who has the login, open it.

Remove (owner only): select the person and choose Remove. After you confirm, their access is taken away and the login's key is changed so their copy opens nothing new. TechieCRM then says "Name may have copied this password. Change it at the site, then update it here." Choose Edit to update it now, or Later.

The Key column shows the start of each person's sharing key fingerprint; if you need to be sure a share went to the right person, compare it with the one on their own computer.

People a login is shared with can use, copy and edit it. Only the owner shares it, removes people, deletes it, or switches it between Business and Personal.

Business or Personal

Each saved login is one of two kinds, chosen under Kept as when you add or edit it (the owner only):

  • Business (the default): a login you use for the office. Your administrator can see that it exists (its title, type, site and owner, never the password) and can make someone else the owner, for example when you leave.
  • Personal: a login that is yours alone. Only you can share it or give it to someone else; an administrator can never see it, open it or move it.

Making someone else the owner

In Share, select a person who already has the login and choose Make owner. After you confirm, they become the owner and you keep using it like anyone else it is shared with. An administrator can do this for a Business login too (see For administrators).

Deleting a login

Select a login you own and choose Delete. After you confirm, it is deleted for everyone who has it, with all its versions. This cannot be undone.

The history of a login

The owner sees a History tab in Share: every time the login was saved, opened for editing, copied, shared, removed, had its key changed, changed owner or was rolled back, with who, when and on which computer. It never shows a password or any other secret. An administrator sees the same history for a Business login.

These events are kept with the login, not in the activity log (A11).

If you forget your TechieCRM password

When an administrator resets your TechieCRM password and you sign in with the new one, TechieCRM notices that your saved logins were locked with the old one and asks your administrators by itself: nothing to type, nothing to remember. The window says your logins are waiting for an administrator. Once one approves, the next time you open the Credential Storage Manager your logins are back.

If an administrator refuses, choose Ask again after talking to them.

If your office never set up a recovery key, your own unshared logins cannot be opened again. Choose Start over to make a new key: logins others shared with you are shared again by their owners' computers.

Another computer where you are still signed in also keeps your logins open; nothing is lost while one of your devices still has them.

For administrators

Administrators (the MASTER login, or a login allowed to change users) see three more tabs.

Recovery requests. A request appears when someone's password was reset and their computer asked for their saved logins back. Each shows the person, the computer it came from and when. Approve only when you know that person's password was just reset: select it and choose Approve, then confirm. Nobody types a code. Their computer finishes the recovery the next time it opens the Credential Storage Manager. Refuse turns down a request you did not expect; the person can ask again. You cannot approve your own request; another administrator must.

Office recovery key. Choose Set up the office recovery key once. It is what lets an administrator restore someone's logins after a password reset. You hold it through your own saved-login keys, so there is no passphrase to keep. Everyone's logins are protected by it the next time they open the manager. Give it to another administrator shares it with a colleague who has opened the Credential Storage Manager at least once. It restores access; it is not a way to browse anyone's logins.

Business logins. Every Business login in the office: title, type, owner, who has it and who is waiting, and when it last changed. Select one and choose People and owner to see its people and history, and to Make owner someone who already has it (for example when the owner leaves). You cannot see a password here, cannot share a login you do not hold, and Personal logins are never listed.

An administrator who holds the office recovery key receives the titles of the office's Business logins on their own computer through the cloud (title, type, sites and owner only); the passwords never reach it.

Where your logins are kept

  • In TechieCRM's MongoDB database, encrypted, and carried between your computers by cloud sync, still encrypted (chapter 13). Cloud backups include them, encrypted.
  • Each login has its own key, locked separately for each person who has it. Your key is unlocked by your approved devices or your TechieCRM password, in memory only.
  • The database administrator, other TechieCRM users and the TechieCRM cloud hold locked copies and cannot read a password.

On the local portal

Your office's local portal (Administrator Guide A13) has the same manager: Tools ▸ Security ▸ Credential Manager opens it as pages, with the same rules for who may use it, the same login types, and the same controls: the types on the left with counts, search, Add, Edit, Copy user name, Copy password, Open site (a new browser tab), Versions and roll back, Share (with Remove, Make owner and the owner's History), Delete, New login type, and for portal administrators an Administration tab with recovery requests, the office recovery key and the Business logins. The saved logins are the same ones the desktop app shows.

What is different on the portal:

  • It opens your saved logins with your TechieCRM password and keeps your keys only in the portal program's memory while you are signed in. Signing in with your TechieCRM ID opens them by itself once you have used the manager; after the portal restarts, or when another part of the server answers your page, it asks "Enter your TechieCRM password to open your saved logins." again. Close or signing out closes them.
  • A saved password never appears in a page: copying fetches it when you click, and when you edit a login its password box is empty (blank keeps the saved one).
  • The page clears the clipboard after 30 seconds when the browser allows it; over a plain connection from another computer it says it cannot, so copy something else when you are done.
  • If your desktop app keeps your saved logins under its mail account key, the portal cannot open them yet; use the desktop app.

Not yet available

  • Test connection for email accounts, database logins and database servers.
  • Signing in to a website from TechieCRM (a sign-in window that fills the user name and password on the exact saved site). Today: Open site, then copy.
  • Mail accounts reading their passwords from the manager, with the move of existing mail passwords into it. (Signing in to the office database with a saved Office database login works on the desktop since October 2026, on SQL and on Mongo offices: see Who can use it.)
  • Shared mailboxes for groups, and sharing with a team that keeps itself up to date.
  • A browser extension that fills saved logins in your own browser.