How PulsVault works
A guided beginner tour of PulsVault end to end — from account creation and your keys, through vaults and items, to unlocking and sharing.
PulsVault is built around one idea: your secrets are encrypted on your device, and only you hold the keys. This page walks the whole journey once, from creating an account to sharing a vault, so the rest of the docs make sense. Each stop links to a deeper page.
1. You create an account — and receive your keys#
When you sign up, you choose a master password and receive an Access Key (shown exactly once) and a Recovery Key. The server keeps only hashes of these — never the real values. Together they form your Emergency Kit, and they matter because everything below is derived from them.
PulsVault cannot resend your Access Key or reset your master password for you. If both are lost, and you don't have your Recovery Key, your secrets cannot be decrypted — by anyone.
2. Signing in is not the same as unlocking#
PulsVault uses a two-gate model:
| Gate | What it proves | What you get |
|---|---|---|
| 1 — Sign in | Who you are (email + password + 2FA) | Access to the app |
| 2 — Unlock | You can decrypt your vaults (Access Key, Recovery Key, or a trusted device) | Your keys in memory, for a session length you choose |
That's why you can be signed in and still see locked vaults: your secrets stay encrypted until you open gate 2, and they re-lock when the vault session expires.
3. Unlocking derives your keys — on your device#
At unlock, your device combines your password and Access Key to derive a Key Encryption Key, which unwraps your User Master Key, which in turn unwraps a separate Data Encryption Key (DEK) for each vault. None of these raw keys ever reach the server — it stores only their encrypted (wrapped) forms. See How encryption works for the full hierarchy.
4. Vaults hold your items#
A vault is both the unit of encryption (its own DEK) and the unit of sharing. Inside, you store typed items — logins, payment cards, passports, SSH keys, secure notes, and more than 20 types in all. Sensitive fields (passwords, PINs, private keys) are each encrypted individually with the vault's DEK before anything leaves your device.
Your primary vault is created with your account, is always AES-256-GCM, and can never be shared — keep your most sensitive secrets there. Read more in Vaults, items & item types.
5. Sharing re-wraps keys, never data#
When you share a vault, PulsVault doesn't decrypt and re-send your items. Instead, the vault's DEK is re-wrapped for the recipient's keys, so they can decrypt the same ciphertext on their own device — at the access level you chose. Revoking access removes their wrapped copy of the key; other vaults are never affected.
What the server actually stores#
The server holds: hashes of your password and of one-way verifiers of your Access Key and Recovery Key, your wrapped master key and vault keys, and ciphertext for every secret field. It never sees your master password, Access Key, raw keys, or any secret in plaintext — so a server breach doesn't expose your secrets. Item names, tags, remarks and non-secret fields are stored readable. See the zero-knowledge model.
Related#
- Zero-knowledge in 2 minutes — the short version
- Quickstart: your first vault & item — do it hands-on
- Choose your path — where to go next for your role