Password vault

02What the module does

• Sensitive data encrypted in the browserPasswords, notes, TOTP keys for one-time codes and custom fields are encrypted directly in the browser using the folder key. They are stored on the server only in encrypted form.
• Only encrypted data on the serverThe server stores only ciphertext and wrapped keys. The only exceptions are the title, URL and username, which stay unencrypted for search.
• Find credentials by nameYou can search credentials by title, URL and username. Because these fields remain unencrypted, search works without revealing passwords.
• Keys protected by your passphraseEach user has their own key pair, and the private key is protected by an Argon2-derived passphrase. A forgotten passphrase cannot be recovered; an administrator can only replace the keys.
• Unattended vaults lock automaticallyAfter a configured period of inactivity—480 minutes by default—the vault automatically locks in the browser. An unattended computer never leaves passwords exposed.
• Share folders with entire teamsShare a folder with individual colleagues or entire teams with immediate effect. Its key is wrapped with the recipient’s public key, so you never forward passwords by hand.
• Temporary access expires automaticallySet an expiration date on a share, after which access ends automatically. Temporary team members never keep vault access longer than intended.
• The owner decides who staysSet a review deadline on a share within which the folder owner approves or revokes it. Once the deadline passes, access is suspended and a late approval will not restore it.
• Clear rules, including explicit denialsVault rules define permissions for a chosen scope and also support explicit denials. You can explicitly block someone from accessing sensitive credentials.
• Know who viewed a passwordRevealing or copying a password is recorded in the access log with the user, IP address and browser. You can trace who accessed a credential at any time.
• Passwords right in the browserA browser extension connects to the vault via OAuth with read or write permissions. You can reach your credentials directly while working on the web.
• Credentials for automation tooService identities have their own key pair for automation. A folder shared with a service identity can be read by the server, while all other folders are decrypted only in the browser.
• GitLab without a token on the serverThe GitLab helper uses a token stored in the vault: the browser decrypts it and sends it with each request. The server never stores the token and records every call in the access log.
• All 13 capabilities in a single module

05Frequently asked questions