Workspace settings
Tier: Starter, Professional, Enterprise
Passwd admins control how records are shared and organized across the whole organization in App settings. The settings apply to every user in your workspace.
To open them, click App settings in the left sidebar. Only Passwd admins can see and change them. The page has four parts:
- General settings: the default role of new shares and who can share publicly.
- Tag managing: rename or delete tags across all records.
- Google Workspace groups visibility: hide internal groups from non-admin users.
- Manage vaults: create and edit team vaults. See Vaults.
General settings
Default role of new users and groups
When someone shares a record with a user or a Google Workspace group, this is the role that is preselected. Choose one of:
- Viewer can view the record but not edit or share it.
- Editor can view, edit and share the record.
- Autofill only can fill login forms with the extension without seeing the password.
- Passkey only can log in with the stored passkey. Available only for records that contain a passkey.
The default is Viewer, the most cautious choice. Whoever shares a record can still pick a different role for each user or group. Changing the default does not affect records that are already shared. For what each role allows, see Roles and whitelist.
Public password sharing
This setting decides who may create a temporary share link, which gives anyone outside your organization access to a record for 24 hours.
| Option | Who can create share links |
|---|---|
| All users | Every user who has Editor access to the record. This is the default. |
| Admins only | Only Passwd admins. |
| Not allowed | Nobody. The Share button for public links is unavailable. |
Switching to a stricter option does not remove existing links. They stay valid until they expire, or until someone with Editor access disables them.
Who can change what
| Passwd admin | Other users | |
|---|---|---|
| See the workspace settings | Yes | No |
| Change the default role | Yes | No |
| Change public password sharing | Yes | No |
| Rename or delete tags | Yes | No |
| Hide Google Workspace groups | Yes | No |
Frequently asked questions
Does the default role also apply to records that already exist?
No. It only changes the role that is suggested the next time someone shares a record.
We set public sharing to "Not allowed", but a user still has a share link.
Links created earlier remain valid until they expire after 24 hours. Disabling the setting prevents new links only.
Why don't I see Settings?
The App settings item is shown to Passwd admins only. If you need access, ask an existing admin to promote you in User administration.