# Padloc privacy rating

Open source, end-to-end encrypted password manager from MaKleSoft with desktop, mobile, browser and web apps, a hosted service and a self-hostable server. The code has had no updates in several years.

## Summary

Padloc scores 68 out of 100 (grade C) on the password managers criteria. It meets 7 of 11 criteria: open source, no ads or data sales, TLS configuration, security headers, end-to-end encrypted vault, local or self-hosted option and full export. It partly meets independent audit. It does not meet no trackers or telemetry, transparency report and tells users about requests. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade A+.

- Website: https://padloc.app
- Source code: https://github.com/padloc/padloc
- License: AGPL-3.0
- Jurisdiction: Germany. Fourteen Eyes member. EU member (GDPR).
- Platforms: Windows, macOS, Linux, Android, iOS, Web
- Home page trackers: none found
- Category: [Password managers](https://privacyratings.com/password-managers/)
- Grade: C (68/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | AGPL-3.0 for the apps and server. | https://github.com/padloc/padloc/blob/main/LICENSE |
| No trackers or telemetry | No | The privacy policy says third-party analytics are used on the public website, and the service tracks anonymised app usage data. | https://padloc.app/privacy/ |
| No ads or data sales | Yes | Funded by paid plans, and the privacy policy says personal data is not sold. | https://padloc.app/ |
| Independent audit | Partial | Radically Open Security audited Padloc 4, and the full report is public but older than three years. | https://padloc.app/assets/audit_reports/radically-open-security_2022.pdf |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=web.padloc.app&hideResults=on |
| Security headers | Yes | Grade A+ (105/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=web.padloc.app |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encrypted vault | Yes | Vault data is encrypted on the device with keys derived from the master password, and the server cannot decrypt it. | https://docs.padloc.app/docs/security/ |
| Local or self-hosted option | Yes | The server can be self-hosted. | https://docs.padloc.app/guides/self-host/ |
| Full export | Yes | Exports vaults to CSV or an encrypted Padloc container. | https://docs.padloc.app/manual/settings/ |

Source: https://privacyratings.com/password-managers/padloc/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/password-managers/padloc.md