Password Vault

All credentials live in one encrypted vault. The vault must be in unlocked state to use SSH, SFTP, or run monitoring.

This page is about usage. The cryptography details are at Security Model.

Three States

State	Means
uninitialized	Master password never set. App will prompt you to create a vault.
locked	Vault exists but the key is not in memory. Credentials unreachable, monitoring paused.
unlocked	Normal. Everything works.

Create Vault

On first app run, you set your master password. A few notes:

• Make the password long rather than complex. Four or five random words beat P@ssw0rd! by far.
• Don’t reuse a password from elsewhere.
• Store it in a password manager immediately after creating it.

No security questions, no email recovery, no back doors. That’s intentional.

Auto-Unlock

After the first unlock, the app caches the data key in your OS keychain (Windows Credential Manager / macOS Keychain / Secret Service on Linux), so the next boot doesn’t ask for the password again.

What’s stored is the data key — not the master password, not the key derived from it. When you press Lock vault, the keychain entry is deleted and the in-memory key is overwritten.

If you want to always type it in, just lock the vault before quitting the app.

Lock Vault vs. Lock Screen

Two different things, often confused:

Lock vault — encryption key is deleted from memory. Background monitoring stops, all credentials become inaccessible. This is real protection.

Lock screen — hides the app window after a period of inactivity (default 15 minutes, adjustable in Settings). The key stays in memory, monitoring still runs, open SSH sessions stay alive.

Why separate them: on a 24/7 machine, a lock mechanism that kills monitoring every 15 minutes will get disabled. Lock screen stops someone walking by the desk; it doesn’t stop someone who can reboot the machine. When you need that level, the Lock vault button sits right on the lock screen.

Change Master Password

Go to Settings → Change Master Password, enter the current one and the new one.

This does more than change the password: it rotates the data key too and re-encrypts all credentials in a single transaction. The practical effect: anyone who previously obtained the old key is now locked out.

If the process gets interrupted (power loss, crash), the transaction is rolled back and the vault stays in its old state — no half-corrupted scenarios.

Argon2 Parameter Upgrade

KDF parameters are stored with the vault, not fixed in source code. When a new release increases the hash cost, your old vault still opens with the old parameters and auto-upgrades to the new ones on the next unlock. You don’t have to do anything.

Forgot Master Password

Cannot be recovered. Your only option is to delete the database file and start fresh: projects, VMs, and credentials all go away.

If you still have keys and passwords elsewhere (password manager, ~/.ssh), rebuilding is mostly re-importing — and Import from ~/.ssh/config handles most of that.