Sensitive fields & reveal
How masked fields work — which values are sensitive, on-demand decryption when you reveal or copy, and clipboard hygiene.
Each item type marks certain fields as sensitive.
Sensitive values are masked everywhere by default (shown as ••••••••) and are only
decrypted on your device, at the moment you ask for them.
Which fields are sensitive#
The type's schema decides. Typical examples:
| Kind of value | Where it appears |
|---|---|
| Passwords | Login, Credential, Email account, Social media, Server, Database, Wireless router, Docker registry |
| PINs | Bank account, Membership, Reward program |
| Keys & secrets | SSH private key, Crypto wallet private key and seed phrase, API credential, Token value, Software license key |
| Card data | Credit card number and verification number |
| Identity numbers | Social security number |
Reveal and hide#
- Open an item — sensitive fields show as masked dots.
- Click Reveal on a field. The value is decrypted on demand with the vault's key and shown in place.
- Click Hide to mask it again. Saving an item also re-masks all fields.
If your vault session has expired you'll see "Locked — Unlock session to decrypt this field": reveal, copy, and history all require an unlocked vault.
Sensitive values aren't decrypted when an item loads — only when you reveal or copy a specific field. The server never has the plaintext at all, and even in API responses sensitive fields are masked. Everything readable exists only briefly in your browser's memory.
Copying values#
Use Copy next to any field. For sensitive fields, the value is decrypted just for the copy and placed on your clipboard, with a confirmation toast.
Under App Settings → Vault General you'll find clipboard hygiene settings: enable Clear Clipboard Automatically and choose a Clear Clipboard After delay of 10, 30, or 60 seconds, or 2 minutes (default 30 seconds), so copied passwords don't linger. Even so, treat the clipboard as untrusted — paste promptly, and avoid copying secrets on shared machines.
Changing a sensitive value#
When you edit and save a sensitive field, the previous value isn't lost: it's kept encrypted in the item's version history, subject to your retention settings. See Item history and Password history.
Related#
- Item types — which fields each type marks sensitive
- How encryption works