Unlocking and locking

How to unlock the vault, how long it stays unlocked across reloads, the idle timeout and 12-hour maximum, and how to lock it.

This page explains how the vault opens and closes, and how to choose how long it stays open.

#Unlock the vault

1. Sign in. See signing in.
2. On Unlock your vault, choose Unlock with passkey and approve the passkey prompt.

One prompt unlocks it. The vault is decrypted on this device only. If you signed in with Sign in with passkey, you are already unlocked.

#Staying unlocked across reloads

You don't need your passkey on every page load. After you unlock, your browser keeps the vault key wrapped under a random device key, and our server holds only that device key. Neither half opens the vault on its own. The server releases the device key only to the same signed-in session, and only while the unlock is live.

Your open StackHangar tabs share one unlocked vault. Activity in any tab keeps all of them unlocked.

#Idle timeout and the 12-hour maximum

The vault locks when:

• You have been idle too long. The default is 15 minutes. The server enforces it as well as your browser.
• 12 hours have passed since you unlocked. After that you sign in again, however active you are.

When this happens, the screen tells you why, for example "Locked after 15 minutes idle. You're still signed in."

#Change the idle time

1. Open Settings, then Security.
2. In Unlock session, set Lock when idle for to 5, 15, 30 or 60 minutes.

The choice applies from your next click. It is kept in this browser, so set it on each browser you use. If the browser won't save settings, the 15-minute default applies. If the change fails, your passkey prompt may have been declined. Try again and approve it.

#Revealing production values

Even when the vault is unlocked, revealing a Production secret needs a passkey check in that tab within the last 2 minutes. After a reload the vault opens without a prompt, but a Production reveal still asks.

#Lock the vault

• Choose Lock now in the sidebar (or the lock button at the top on a phone). It locks every open tab and ends the unlock. You stay signed in.
• Choose Sign out to lock the vault and sign out of this browser. It is in the sidebar and under Settings, Account.

#If something goes wrong

• The unlock prompt closed without a passkey. Try again, and choose your phone or security key in the prompt if this device has none of your passkeys.
• That passkey isn't one of this vault's passkeys. Try another of yours.
• No passkey works. Use Lost your passkeys? with your recovery key. See recovery key.

Something missing or wrong on this page? Tell us.