Passbolt Tags Functionality

Design Discussions

Jan 15, 2018 · 7 min read
Image for post
Image for post

Some of the most expected features of passbolt are categories (also called folders) and tags (also called labels). Since multiple approaches are possible for the design of these features, we wanted to take a step back, share some of our thoughts and discuss the options with you.

What problem does it solve?

How are tags different than categories?

Image for post
Image for post
Fig. choose your mental mental models

Why start with tags instead of categories?

How can/will people use tags?

Projects: As any overpaid corporate management consultant would tell you, transversal organizational structures are the future. Project managers will love this.

Image for post
Image for post
Fig. Welcome to the matrix.

Flags: similar to “favorites”, tags can be used to bring attention to a given item. This helps with the deduplication or the moderation of not suitable for work (NSFW) passwords.

Statuses: Tags can also be useful to identify which resource (the password or the system it is associated with) requires a given action. A workflow process, for example, can use tags to show what needs to be done:

Image for post
Image for post
Fig. Example of productive publishing workflow

Properties: for example a given system administrator manages multiple servers with different authentication mechanisms (SSH, 2FA, etc.) or the network section (DMZ, VPN, etc.) or any other fancy three letter acronym system. In short, tags would be a good way to confuse the mortals the sysadmin want to keep in the dark.

Tires on burning pile of garbage: let’s not fool ourselves, even with a concerted effort to create a shared taxonomy, tagging is going get messy. Similarly with a bottom down approach the taxonomy may end up being tedious and therefore only used by the person who designed it. We recommend you hold several, long-winded meetings over the course of months debating and discussing the taxonomy that works for your organisation.

Should the tags be kept personal or be shared?

The design needs to strike a balance between these two conflicting approaches.

Option 1. My tags are only set and seen by me:

Image for post
Image for post
Fig. A productive inbox using labels

The first approach is similar to tagging in most web clients. The biggest advantage is that all the tags are relevant to the user, since they are the one creating them. Conversely the user can set its own organisation system without having to inflict it on other people. This will surely reduce semantic bickering.

The main issue is that this system does not allow people to collaborate. Interestingly this also has an impact on the learning experience, since there is no way to see how other people are using tags.

Conclusion: Since collaboration is at the heart of passbolt this option alone is not sufficient.

Option 2. Tags are set by the password owner (or people who can edit):

Image for post
Image for post
Fig. A not so productive post with tags

Much like tagging articles in a CMS, or duckfaces on Instagram posts, tags could also be set by the content creator. Many opportunities arises when tags are shared since they can be used to collaborate. For example, they could be used to help somebody else isolate/identify a set of passwords, or they could be used to group resources by projects.

The main issue with this approach is that, even if you do not see the tags of the resources you do not have access to, not all the tags will be relevant to you. Tags can also have different meaning for different groups of people. For example, one group decides that the tag “to update” means that one needs to update the credential. Another group might decide this tag means an update for the underlying system is needed. If you are member of both groups then good luck getting your bonus. Similarly some content creators could be more heavy handed than others and their overtagging habit may increase the effort needed to use them.

Conclusion: this option allows to collaborate but is prone to create a lot of unmoderated content and therefore make the feature less interesting to use over time.

Option 3. The taxonomy is defined by the admin and tags are set by the owner (or people who can edit)

Image for post
Image for post
Fig. a productive github issue board

Similar to the solution chosen on Github’s issue board, and to deal with the drawbacks of option2, it is possible to create a pre-moderated tag list that the content creator needs to choose from. The biggest advantage of planning the taxonomy in advance is that it will provide the perfect opportunity for a meeting where self-appointed specialists can discuss what is best for the rest of the organisation. While this could be seen as another pointless bureaucratic overhead by some, this option will certainly help keep things tidy.

Option 4. A combination of some of these options, e.g both personal and shared tags.

While this approach is the most flexible, it is also raises different challenges to explain these complex concepts to the user in an intuitive way. It is also more complex to develop and test, which would delay the rollout of this feature. Finally, this option might be risky for users who accidently create shared tags that say things about their pointy haired boss.

Bonus questions

Should capitalization be allowed in the tags?

Our prefered approach would be that all tags are set to lower case by default, ‘Alpha’ and ‘alpha’ are the same tag and displayed as ‘alpha’ at all times. User can enter either of them, but the input is transformed to lower case while saving server side. We will go with this option unless you absolutely beg us to change our minds.

How will it look?*

Image for post
Image for post
Fig. *suggestion of presentation

First iteration

  • People must be able to see tags in both the left and right sidebars. Click on a tag should filter the password using this tag. Similarly it should possible to get relevant search results using tags as input.
  • The tag editor must be easy is to use and work well with the mouse and/or keyboard. Users should see a list of proposed tags when adding/editing tags to promote tag reuse. The tag editor should prevent people from entering the same tag twice.

Future plans

We will also consider creating a tree-like hierarchy within the tags using “/” delimiter.

Update: Survey results

What would be the best tagging system?

Image for post
Image for post

Should the tags be lower case?

Image for post
Image for post

Some of the feedback was very interesting and brought forward some new ideas:

We would like to see the tagging system open, flexible and general similar to Slack and Twitter, etc… anyone with edit access can add any tag, tags can be prefixed by special character like “#” or ‘@’ to indicate a group, user or system level tag.

We will now work on the functional and specifications before moving on to the implementation in v.2.0. As always feel free to reach out by email or on the forum if you have questions, concerns or new ideas.


open source password manager for teams

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store