The following directories hold various components of PassMan. sql/ Holds SQL scripts for the backing MySQL database. There is a separate INSTALL document in that directory. www/ Holds the web site. This directory should be copied somewhere and configured to be served up, which MUST be password protected. This password protection is the only thing stopping a third party accessing your data. While they would need to know the passphrase to see your passwords, anyone accessing the site can delete and edit entries. How this is accomplished will differ from web server to web server. It is recommended to run the site over HTTPS to prevent the password being easily sniffed. The web server must be able to execute PHP. config.php should be edited and the instructions followed for each config item.