Password Security

When you set up a project that needs a login, you give Testifly a test account (username/email and password) so our AI agents can sign in and test the pages behind your login. This page explains exactly what happens to that password.

1. Your password is never stored in our database

The password you type in during project setup is never written to our main database. Only the username/email, role, and login-related metadata (like the last magic-link timestamp) are saved there — the password field is dropped before anything is saved to the database.

2. Your password is stored encrypted, in a dedicated secrets vault

Instead of the database, your password is stored in Azure Key Vault, a secrets-management service built for exactly this purpose. Before it’s written to the vault, it goes through an extra layer of encryption on our side:

• The password is encrypted with AES-256-GCM, a strong, industry-standard encryption algorithm.
• The encryption key is derived specifically for your project and environment (so a key for one project/environment can’t decrypt another’s data), using HKDF-SHA256.
• Azure Key Vault then also encrypts everything at rest on its own.

That means your password is protected by two independent layers of encryption: our own encryption before it’s sent, and Key Vault’s encryption once it’s stored.

3. Your password is only ever used to run your automated tests

When a test run needs to log in to your site, our test worker fetches the encrypted password from the vault, decrypts it in memory, and hands it directly to the automated Playwright login step so it can fill in your site’s login form — the same way a human tester would type it in. It’s held in memory only for the duration of that test run and is not written to logs, databases, or test reports.

4. Your password never round-trips back to your browser

Once you’ve saved a password, the Testifly dashboard never shows it back to you or sends it back over the network. If you open the project settings again, the password field appears blank/masked, and if you don’t change it, we know to keep the existing vaulted value rather than treating a placeholder as your real password.

If you have any questions about how we handle your credentials, reach out to us at support@testifly.dev.