Bottom line: The European password manager Passwork is developed by Russian founders, shares identical source code with a Russian variant certified by Russian security authorities, and supplies sanctioned defense contractors.
An investigation by OCCRP and partner media documents close technological connections between the password manager Passwork Europe, marketed as European with the “Made in EU” label, and a Russian sister company with state certifications. Numerous European authorities and institutions use the software without having been informed of these connections.
Passwork Europe S.L., based in Spain, is marketed online as a European solution with the “Made in EU” label and is in use at several European authorities, Dresden University of Technology, and Irish government agencies. However, research shows that the software was originally developed by two Russian founders in Archangelsk. Updates for the European version are delivered through a company in the United Arab Emirates run by one of the Russian co-founders. The founders also control the Russian firm Passwork LLC, which uses the identical logo and counts sanctioned Russian defense contractors among its customers.
Security researchers found that the installation scripts of both products contain nearly identical source code across more than 500 lines. Software updates such as version 7.6 were released on both platforms in April 2024 just one day apart, with matching feature descriptions. The Russian counterpart Passwork LLC holds certifications from FSTEC (an agency of the Russian Ministry of Defense) and the FSB. Such certifications in Russia typically require submission of the complete source code to government-accredited laboratories to identify vulnerabilities or undisclosed functions.
Bart van den Berg, security expert at the Clingendael Institute, warns that access to the source code could give the Russian state “far-reaching insights into the software and its vulnerabilities or even intentionally add elements to it”. Regulatory expert Alessandra Chirico emphasizes: “In cybersecurity, trust is not simply a commercial claim. The stronger the narrative of trust, the greater the corresponding transparency obligation required to maintain it.” To date, there is no evidence of manipulation of the European source code or data compromise.
Alexander Muntyan, CEO and sole shareholder of Passwork Europe, denies active business ties and emphasizes that the Spanish and Russian companies do not share customers, servers, support systems, or administrative access. He attributes the code similarities to their shared origin. The software is based on a zero-knowledge principle in which encryption and decryption take place exclusively locally on the customers’ private servers. Explicit statements on the website that there are no connections to Russian entities were removed following press inquiries. The majority of European customers were not informed of the Russian background.
Source: www.it-daily.net · Published 20 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.