A passkey opens this vault. The key that decrypts it lives in no server: each device
holds its own copy, wrapped by its own passkey, and the entries never leave this browser unsealed.
open it
create it
Your passkey wraps a random key that lives in this vault. You will be shown a recovery code once: it is
the only way in from a device without that passkey, and there is no other reset.
the recovery code
Write this down now. It is shown once and it is the only way into this vault from a
device that does not have your passkey. Put it in your password manager.
an older vault
An older vault of yours is sealed under a passkey from the earlier format. Press that passkey once and
its entries are copied into a new vault under this one's rules.
entries
This vault has no entries yet.
carry it as a file
The same envelope the server holds, openable by the recovery code. With the box ticked, a save writes
the file and sends nothing.
change the key
This makes a new data key and a new recovery code, and keeps only the keys you name. A device that is
lost stops being able to read this vault, and the old code stops working the moment this is saved.
Write the new code down before you save. Nothing here can recover it for you.
the envelope
This is the vault itself, sealed. Keep it wherever you keep files.