# nextcloud/passman architecture

> Architecture diagram of the GitHub repository nextcloud/passman, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nextcloud/passman
- Repository: https://github.com/nextcloud/passman

## Overview

Passman is a Nextcloud password manager. Users unlock and manage vaults in the browser; credentials are encrypted client-side before API persistence, and can be searched, revised, shared, or imported and exported. The README also documents OTP generation, password analysis, multiple vaults, and internal or link sharing. The graph includes those product branches, but sampled excerpts do not establish all frontend-to-service wiring, so uncertain call paths are omitted; unsampled subsystems use their enclosing source directories.

Main entry points: [`js/app/app.js`](https://github.com/nextcloud/passman/blob/master/js/app/app.js) (Passman UI), [`appinfo/routes.php`](https://github.com/nextcloud/passman/blob/master/appinfo/routes.php) (API routes), [`lib/Controller/ShareController.php`](https://github.com/nextcloud/passman/blob/master/lib/Controller/ShareController.php) (Sharing API), [`js/app/controllers/vault.js`](https://github.com/nextcloud/passman/blob/master/js/app/controllers/vault.js) (Vault workflow)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_client["Browser app"]
  node_frontend["Passman UI<br/>[app.js]"]
  node_vault_ui["Vault workflow<br/>[vault.js]"]
  node_credential_ui["Credential editing<br/>[main.js]"]
  node_import_ui["Import workflow<br/>[import.js]"]
  node_export_ui["Export workflow<br/>[export.js]"]
end

subgraph group_api["Nextcloud API"]
  node_api_routes["API routes<br/>[routes.php]"]
  node_vault_controller["Vault API"]
  node_share_controller["Sharing API"]
  node_other_controllers["Other API handlers"]
end

subgraph group_security["Credential security"]
  node_client_crypto["Client encryption<br/>[encryptservice.js]"]
  node_server_crypto["Server encryption<br/>[EncryptService.php]"]
end

subgraph group_data["Persistence and services"]
  node_vault_service["Vault service<br/>[VaultService.php]"]
  node_share_service["Sharing service<br/>[ShareService.php]"]
  node_file_service["File service<br/>[FileService.php]"]
  node_vault_store[("Vault records<br/>[VaultMapper.php]")]
  node_sharing_store[("Sharing records")]
end

subgraph group_capabilities["Product capabilities"]
  node_credential_stage["Credential operations"]
  node_sharing_ui["Share settings<br/>[share.js]"]
  node_importers["Format importers<br/>[import-main.js]"]
  node_exporters["CSV and JSON export<br/>[exporter-main.js]"]
  node_otp["OTP generator<br/>[otpauth.umd.js]"]
  node_password_tools["Password analysis"]
  node_search["Credential search<br/>[Provider.php]"]
end

node_user(("User"))
node_nextcloud(("Nextcloud"))

node_user -->|"uses"| node_frontend
node_frontend -->|"routes to"| node_vault_ui
node_frontend -->|"routes to"| node_credential_ui
node_frontend -->|"routes to"| node_import_ui
node_frontend -->|"routes to"| node_export_ui
node_frontend -->|"sends API requests"| node_api_routes
node_api_routes -->|"dispatches vault routes"| node_vault_controller
node_api_routes -->|"dispatches share routes"| node_share_controller
node_api_routes -->|"dispatches other routes"| node_other_controllers
node_vault_ui -->|"encrypts credentials"| node_client_crypto
node_credential_ui -->|"encrypts credentials"| node_client_crypto
node_import_ui -->|"selects importer"| node_importers
node_export_ui -->|"selects exporter"| node_exporters
node_vault_controller -->|"manages vaults"| node_vault_service
node_vault_service -->|"reads and writes"| node_vault_store
node_share_controller -->|"manages sharing"| node_share_service
node_share_controller -->|"manages shared files"| node_file_service
node_share_service -->|"reads and writes"| node_sharing_store
node_share_controller -->|"uses credentials"| node_credential_stage
node_sharing_ui -->|"sends sharing requests"| node_api_routes
node_vault_ui -->|"sends vault requests"| node_api_routes
node_credential_ui -->|"sends credential requests"| node_api_routes
node_credential_stage -->|"encrypts stored data"| node_server_crypto
node_frontend -->|"generates OTP"| node_otp
node_frontend -->|"provides password tools"| node_password_tools
node_nextcloud -->|"hosts API"| node_api_routes
node_nextcloud -->|"registers provider"| node_search

click node_frontend "https://github.com/nextcloud/passman/blob/master/js/app/app.js"
click node_vault_ui "https://github.com/nextcloud/passman/blob/master/js/app/controllers/vault.js"
click node_credential_ui "https://github.com/nextcloud/passman/blob/master/js/app/controllers/main.js"
click node_import_ui "https://github.com/nextcloud/passman/blob/master/js/app/controllers/import.js"
click node_export_ui "https://github.com/nextcloud/passman/blob/master/js/app/controllers/export.js"
click node_api_routes "https://github.com/nextcloud/passman/blob/master/appinfo/routes.php"
click node_vault_controller "https://github.com/nextcloud/passman/blob/master/lib/Controller/VaultController.php"
click node_share_controller "https://github.com/nextcloud/passman/blob/master/lib/Controller/ShareController.php"
click node_other_controllers "https://github.com/nextcloud/passman/tree/master/lib/Controller"
click node_client_crypto "https://github.com/nextcloud/passman/blob/master/js/app/services/encryptservice.js"
click node_server_crypto "https://github.com/nextcloud/passman/blob/master/lib/Service/EncryptService.php"
click node_vault_service "https://github.com/nextcloud/passman/blob/master/lib/Service/VaultService.php"
click node_share_service "https://github.com/nextcloud/passman/blob/master/lib/Service/ShareService.php"
click node_file_service "https://github.com/nextcloud/passman/blob/master/lib/Service/FileService.php"
click node_vault_store "https://github.com/nextcloud/passman/blob/master/lib/Db/VaultMapper.php"
click node_sharing_store "https://github.com/nextcloud/passman/blob/master/lib/Db/SharingACLMapper.php"
click node_credential_stage "https://github.com/nextcloud/passman/tree/master/lib/Service"
click node_sharing_ui "https://github.com/nextcloud/passman/blob/master/js/app/controllers/share.js"
click node_importers "https://github.com/nextcloud/passman/blob/master/js/importers/import-main.js"
click node_exporters "https://github.com/nextcloud/passman/blob/master/js/exporters/exporter-main.js"
click node_otp "https://github.com/nextcloud/passman/blob/master/js/lib/otpauth.umd.js"
click node_password_tools "https://github.com/nextcloud/passman/tree/master/js/app"
click node_search "https://github.com/nextcloud/passman/blob/master/lib/Search/Provider.php"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_frontend,node_vault_ui,node_credential_ui,node_import_ui,node_export_ui,node_user toneBlue
class node_api_routes,node_vault_controller,node_share_controller,node_other_controllers toneAmber
class node_client_crypto,node_server_crypto toneMint
class node_vault_service,node_share_service,node_file_service,node_vault_store,node_sharing_store toneRose
class node_credential_stage,node_sharing_ui,node_importers,node_exporters,node_otp,node_password_tools,node_search,node_nextcloud toneIndigo
```

## Components

### Browser app

- [Passman UI](https://github.com/nextcloud/passman/blob/master/js/app/app.js): `js/app/app.js`
- [Vault workflow](https://github.com/nextcloud/passman/blob/master/js/app/controllers/vault.js): `js/app/controllers/vault.js`
- [Credential editing](https://github.com/nextcloud/passman/blob/master/js/app/controllers/main.js): `js/app/controllers/main.js`
- [Import workflow](https://github.com/nextcloud/passman/blob/master/js/app/controllers/import.js): `js/app/controllers/import.js`
- [Export workflow](https://github.com/nextcloud/passman/blob/master/js/app/controllers/export.js): `js/app/controllers/export.js`

### Nextcloud API

- [API routes](https://github.com/nextcloud/passman/blob/master/appinfo/routes.php): `appinfo/routes.php`
- [Vault API](https://github.com/nextcloud/passman/blob/master/lib/Controller/VaultController.php): `lib/Controller/VaultController.php`
- [Sharing API](https://github.com/nextcloud/passman/blob/master/lib/Controller/ShareController.php): `lib/Controller/ShareController.php`
- [Other API handlers](https://github.com/nextcloud/passman/tree/master/lib/Controller): `lib/Controller`

### Credential security

- [Client encryption](https://github.com/nextcloud/passman/blob/master/js/app/services/encryptservice.js): `js/app/services/encryptservice.js`
- [Server encryption](https://github.com/nextcloud/passman/blob/master/lib/Service/EncryptService.php): `lib/Service/EncryptService.php`

### Persistence and services

- [Vault service](https://github.com/nextcloud/passman/blob/master/lib/Service/VaultService.php): `lib/Service/VaultService.php`
- [Sharing service](https://github.com/nextcloud/passman/blob/master/lib/Service/ShareService.php): `lib/Service/ShareService.php`
- [File service](https://github.com/nextcloud/passman/blob/master/lib/Service/FileService.php): `lib/Service/FileService.php`
- [Vault records](https://github.com/nextcloud/passman/blob/master/lib/Db/VaultMapper.php): `lib/Db/VaultMapper.php`
- [Sharing records](https://github.com/nextcloud/passman/blob/master/lib/Db/SharingACLMapper.php): `lib/Db/SharingACLMapper.php`

### Product capabilities

- [Credential operations](https://github.com/nextcloud/passman/tree/master/lib/Service): `lib/Service`
- [Share settings](https://github.com/nextcloud/passman/blob/master/js/app/controllers/share.js): `js/app/controllers/share.js`
- [Format importers](https://github.com/nextcloud/passman/blob/master/js/importers/import-main.js): `js/importers/import-main.js`
- [CSV and JSON export](https://github.com/nextcloud/passman/blob/master/js/exporters/exporter-main.js): `js/exporters/exporter-main.js`
- [OTP generator](https://github.com/nextcloud/passman/blob/master/js/lib/otpauth.umd.js): `js/lib/otpauth.umd.js`
- [Password analysis](https://github.com/nextcloud/passman/tree/master/js/app): `js/app`
- [Credential search](https://github.com/nextcloud/passman/blob/master/lib/Search/Provider.php): `lib/Search/Provider.php`

### Other components

- **User**
- **Nextcloud**

## Connections

- User → Passman UI: uses
- Passman UI → Vault workflow: routes to
- Passman UI → Credential editing: routes to
- Passman UI → Import workflow: routes to
- Passman UI → Export workflow: routes to
- Passman UI → API routes: sends API requests
- API routes → Vault API: dispatches vault routes
- API routes → Sharing API: dispatches share routes
- API routes → Other API handlers: dispatches other routes
- Vault workflow → Client encryption: encrypts credentials
- Credential editing → Client encryption: encrypts credentials
- Import workflow → Format importers: selects importer
- Export workflow → CSV and JSON export: selects exporter
- Vault API → Vault service: manages vaults
- Vault service → Vault records: reads and writes
- Sharing API → Sharing service: manages sharing
- Sharing API → File service: manages shared files
- Sharing service → Sharing records: reads and writes
- Sharing API → Credential operations: uses credentials
- Share settings → API routes: sends sharing requests
- Vault workflow → API routes: sends vault requests
- Credential editing → API routes: sends credential requests
- Credential operations → Server encryption: encrypts stored data
- Passman UI → OTP generator: generates OTP
- Passman UI → Password analysis: provides password tools
- Nextcloud → API routes: hosts API
- Nextcloud → Credential search: registers provider