Vaults overview
What vaults are, the difference between your primary, personal, and shared vaults, and how to create, configure, unlock, and lock them.
A vault is an encrypted container for your items. It's the unit of encryption (its own Data Encryption Key) and the unit of sharing. This page covers day-to-day vault management.
Types of vault#
- Primary — every account has one. Always AES-256-GCM, never shareable, ideal for your most sensitive items.
- Personal — extra private vaults you create and own.
- Shared — vaults you share with people, or that a team/organization assigns to you.
Create a vault#
- Open Vaults and choose New vault.
- Name it and add an optional description.
- Pick an encryption type. Every plan gets AES-256-GCM; Team adds ChaCha20-Poly1305, Business adds AES-256-CBC + HMAC, and Enterprise adds XChaCha20-Poly1305. The ones your plan doesn't include are still listed, greyed out, so you can see what a higher plan adds. The choice is permanent — see below.
- Save. The vault opens unlocked and ready for items.
A vault's algorithm cannot be changed after it is created — every item inside is encrypted with it. Settings shows it, but read-only. If you need a different algorithm, create a new vault and move the items across.
Vault settings#
Open a vault and choose its Settings to manage that one vault. The page has these sections:
General profile — the only part you edit and then save.
- Name, Description (optional) and Icon.
- Switches: Active workspace (the vault the Workspace page opens; only one vault at a time), Default vault (where new secrets land when you don't choose a vault; only one at a time) — both are owner-only and are not offered on an archived vault — plus Favorite (pins the vault to your sidebar and the Favorites tab) and Safe for travel (keeps the vault on your devices when Travel mode is on).
- Save changes is greyed until you change something, and Unsaved changes shows while you have edits pending.
Security — read-only facts: the Algorithm (fixed when the vault was created) and Key generation (v1, v2, … — how many times the vault key has been replaced).
The vault's owner also sees Rotate key here, except on the primary vault. Rotation re-encrypts every item and note under a fresh key, so anyone who lost access earlier permanently loses the ability to read the vault. Keep the tab open until it finishes.
Removing someone from a vault stops the server from handing them new data, but they may still hold the old key and anything they already synced. Because PulsVault is zero-knowledge, the server cannot re-encrypt your items for you; only a browser that holds the key can. Rotating is how you close that gap. When it is owed, a banner reads This vault needs a new key — "Someone lost access to this vault but still holds the old key, so they can still read data they already synced" — with a Rotate now button for the owner. Everyone else sees that only the vault owner can do it.
Cloud storage — shows the Cloud folder pinned to this vault, with Disconnect if one is connected, or Not connected.
Project membership — on plans with Projects, shows which project owns the vault and lets you attach or detach it. It is not shown for the primary vault.
Danger zone (owner only):
- Archive makes the vault read-only — items can't be modified, added or deleted — and Unarchive restores it.
- Delete vault moves the vault and its contents to the Trash, where you can recover it. It is only offered if you have permission to delete vaults.
Who has access to a vault is not on this page. It lives on the separate Sharing & Members screen — see Share a vault.
How long the vault stays unlocked and how long copied values stay on the clipboard apply to all your vaults, not to one. Clipboard behaviour is under App settings → Vault General.
About this vault#
The About page (the info icon beside the vault's actions, and linked from Settings) is a read-only record of the vault that every person who can open it may view:
- What it holds — counts of Secrets, Notes, Tasks and Files. Anything in the Trash is not counted.
- History — Created, Last modified, and the Vault ID (select it to copy).
- People — everyone who holds a key to the vault, with their access level and since when, and Manage if you may change it. A Custodian badge marks people who hold the vault as an organization custodian.
- Teams — each team granted the vault, its member count, and how many members are still waiting for a key.
- Encryption and Key generation. The About page cannot rotate the key; that is a Settings action, and only the owner can do it.
The primary vault is never shareable, so it shows no People or Teams sections.
Taking over a vault#
When an organization hands a vault to you, a banner appears at the top of the Vaults list:
"
You must have your vault unlocked first — until then the banner says "Unlock your vault first — accepting re-seals its key with yours." Then choose Accept ownership. Accepting re-seals the vault's key with your own, so the vault is encrypted for you exactly as if you had created it. If someone is later left holding an old key, the vault is flagged for key rotation.
Unlock and lock#
Opening a vault requires an unlocked session. If your session has expired you'll be prompted to unlock with your Access Key (together with your password, unless you signed in within the last five minutes) a trusted device, or a passkey you set up for unlocking. Vaults re-lock automatically when the session times out, when you reload the page, when you sign out, or when you lock manually — and a lock in one tab locks your other tabs too.
Before crossing a border or using a risky network, enable Travel mode to keep only the vaults you choose accessible.
What's inside#
See Vaults, items & item types for the data model, and Create & manage items for the workflow.