The vault

What the vault is, how it is encrypted on your device, and how passkeys and the recovery key open it.

The vault is where StackHangar keeps everything you save: items and their values, accounts, project names, notes and dates. It is encrypted on your device. StackHangar stores only the encrypted result.

#How it works

• A random vault key is made in your browser. It encrypts every record, including item names, notes and project names.
• Each of your passkeys holds its own wrapped copy of that key, and so does your recovery key. Any one of them opens the vault.
• The vault key never leaves your device unwrapped.

There is no master password.

#In this section

• Unlocking and locking: how long the vault stays open and how to lock it.
• Passkeys: add and remove them, and why you want two.
• Recovery key: your way back in if every passkey is lost.
• Rotate the vault key: replace the key if a device may have been exposed.
• Export: download everything in plain text on your device.
• What we can and can't see: exactly what the server knows.

In this section

• Unlocking and lockingHow to unlock the vault, how long it stays unlocked across reloads, the idle timeout and 12-hour maximum, and how to lock it.
• PasskeysAdd and remove passkeys, why you should have two, and what the passkey check is.
• Recovery keyWhat the recovery key is, how to save it, how to use it if you lose every passkey, and how to repair or replace it.
• Rotate the vault keyWhen to rotate the vault key, how to do it, what it protects against, and how to finish an unfinished rotation.
• ExportExport everything in your vault to a file on your device, decrypted locally, after a passkey check. Works on any plan.
• What we can and can't seeWhat StackHangar's servers can see, and what they never receive. Secrets are encrypted and decrypted only on your device.

Something missing or wrong on this page? Tell us.