A non-transitory computer readable storage medium comprising instructions that, when executed by at least one processor, cause a content management system to: provide access to a shared folder of a content management system to a first client device associated with a first user account and a second client device associated with a second user account, the shared folder including a hierarchy of subfolders for storing a set of passwords; provide, to the first client device, a public key set comprising a public encryption key associated with the second client device; receive, from the first client device for storage within the shared folder: an encrypted payload comprising a set of passwords; and an encrypted shared encryption key that is utilized to encrypt the payload, the shared encryption key being encrypted utilizing the public key set; assign, for the second client device, an access permission for the shared folder that corresponds with a password permission that designates a limited access level to one or more passwords of the set of passwords by determining an access control level relative to a subfolder of the one or more subfolders of the shared folder, the subfolder comprising the one or more passwords; and in response to receiving a request to access the content of the shared folder from the second client device, provide the one or more passwords to the second client device per the access permission for the shared folder by: providing the encrypted payload and the encrypted shared encryption key to the second client device to cause the second client device to decrypt the encrypted shared encryption key with a private encryption key associated with the client device and decrypt the encrypted payload with the shared encryption key; utilizing the assigned access permission for the shared folder to restrict access by the second client device to the subfolder comprising the one or more passwords. provide access to a shared folder of a content management system to a first client device associated with a first user account and a second client device associated with a second user account, the shared folder including a hierarchy of subfolders for storing a set of passwords; provide, to the first client device, a public key set comprising a public encryption key associated with the second client device; receive, from the first client device for storage within the shared folder: an encrypted payload comprising a set of passwords; and an encrypted shared encryption key that is utilized to encrypt the payload, the shared encryption key being encrypted utilizing the public key set; an encrypted payload comprising a set of passwords; and an encrypted shared encryption key that is utilized to encrypt the payload, the shared encryption key being encrypted utilizing the public key set; assign, for the second client device, an access permission for the shared folder that corresponds with a password permission that designates a limited access level to one or more passwords of the set of passwords by determining an access control level relative to a subfolder of the one or more subfolders of the shared folder, the subfolder comprising the one or more passwords; and in response to receiving a request to access the content of the shared folder from the second client device, provide the one or more passwords to the second client device per the access permission for the shared folder by: providing the encrypted payload and the encrypted shared encryption key to the second client device to cause the second client device to decrypt the encrypted shared encryption key with a private encryption key associated with the client device and decrypt the encrypted payload with the shared encryption key; utilizing the assigned access permission for the shared folder to restrict access by the second client device to the subfolder comprising the one or more passwords. providing the encrypted payload and the encrypted shared encryption key to the second client device to cause the second client device to decrypt the encrypted shared encryption key with a private encryption key associated with the client device and decrypt the encrypted payload with the shared encryption key; utilizing the assigned access permission for the shared folder to restrict access by the second client device to the subfolder comprising the one or more passwords.