/
Menu

Rotate the vault key

When to rotate the vault key, how to do it, what it protects against, and how to finish an unfinished rotation.

Rotating replaces the key that encrypts your vault with a new one. Everything is re-encrypted on your device and swapped in one step. If anything doesn't match, nothing changes.

#When to rotate

Rotate if a device, browser profile or recovery key may have been exposed while your vault was unlocked: a lost or stolen laptop, malware, or a recovery key someone may have seen.

Warning

Rotating stops the old key from opening your vault. It can't undo what someone already saw. Also rotate the credentials stored in the vault, using the Rotate and Leaked key playbooks.

#Before you start

  • You get a new recovery key, and the current one stops working.
  • Each passkey you keep needs one passkey check during the rotation. Passkeys you leave unticked are removed. You can add them again later.
  • If malware may have run on a device while you unlocked there, also remove and re-add each passkey you used on it.
  • The vault must be unlocked on this device.

#Rotate

  1. Open Settings, find Vault data and Vault key, and choose Rotate vault key.
  2. Under Passkeys to keep, untick any you don't have with you. Keep at least one.
  3. Leave Sign out every other browser and device ticked unless you are sure no other device is at risk.
  4. Choose Rotate now. Your vault is re-encrypted, and the screen shows progress.
  5. Use each kept passkey when asked, to give it the new key.
  6. Save the new recovery key, tick I saved it, and choose Continue.
  7. Approve with your passkey to switch to the new key.
  8. StackHangar checks that everything opens with the new key, then deletes the old key's copies.
  9. Choose Done, then rotate the credentials stored in your vault.

If any entry doesn't open with the current key (damaged or changed outside StackHangar), you are asked to delete it and continue.

#Finish an unfinished rotation

If a rotation stopped before the check, a banner says "A key rotation isn't finished". Choose Finish now. StackHangar checks every entry opens with the new key and then deletes the old key's copies.

If some entries don't open, the banner offers Finish anyway. Those entries stay unreadable and you should delete them. The old key's copies are removed.

#What it doesn't do

Other open tabs in this browser rejoin the new key by themselves.

  • It doesn't help against a stolen passkey. Remove that passkey too.
  • It doesn't reach backups outside StackHangar's database that may still hold old encrypted data until they age out.

#If something goes wrong

  • The passkey prompt closed. Nothing changed.
  • Another change happened meanwhile, such as a passkey added or removed. Start again.