Best practices

Practical habits that get the most out of PulsVault's security model. Work through the individual checklist first; the admin checklist adds what matters when you manage others.

For every user#

Protect your keys

• Use a long, unique master password you use nowhere else. PulsVault checks it at sign-in but stores only a one-way hash, and it can't reset it for you, so its strength is entirely up to you.
• Store your Emergency Kit offline: print it or keep it on an encrypted USB drive, ideally in a safe. Losing both your password and Recovery Key means unrecoverable data.
• Never share your master password, Access Key, or Recovery Key with anyone — support will never ask for them.

Harden your account

• Enable TOTP two-factor authentication and store the backup codes with your Emergency Kit. See Two-factor authentication.
• Register the devices you use daily as trusted devices so unlocking is easy without weakening security, and remove devices you no longer own.
• Review active sessions occasionally and revoke anything you don't recognize.

Keep your vault healthy

• Use the password generator for every new credential — never reuse passwords.
• Check password health for weak, reused, or old passwords, and turn on breach monitoring.
• Keep your most sensitive items in your primary vault — it is never shareable.
• Set a short vault auto-lock delay and enable clipboard auto-clear in vault settings (Vaults overview).
• Enable Travel mode before crossing borders or using untrusted networks.

For family organizers#

Family

• Share vaults rather than individual passwords, and give each member the lowest useful access level.
• Set up shared family vaults and family policies for younger members.
• Make sure every member completes their own Emergency Kit — you cannot recover their accounts for them.

For team & business admins#

Team Business Enterprise

• Apply least privilege: use roles & permissions and grant vault access by role, not by habit.
• Enforce password & authentication policies (2FA requirements, password rules) organization-wide.
• Route sharing through the approval queue where your plan supports it.
• Review the audit logs regularly — the hash-chained audit trail is tamper-evident, but only useful if someone reads it.
• Configure session limits under session & access control and schedule backups.
• Offboard deliberately: remove the member, revoke their sessions, and rotate any secrets they had access to (seat management).