Getting Started

Let's create a team and store a secret encrypted to your personal identity. You'll need a supported browser and somewhere private to store an unlock passphrase and identity backup.

Create your account and team

1. Register or sign in with an available login method.
2. Create your first team with a name and team URL.
3. Open the team dashboard.

Team creation does not require an encryption phrase. Account authentication gets you into the team and makes asset metadata visible.

Enroll your personal identity

1. Under Create your vault identity, enter an Unlock passphrase of at least 12 characters.
2. Repeat it under Confirm unlock passphrase.
3. Select Create identity.
4. Select Download identity backup and store the file privately.
5. Select Continue.

The browser generates an age identity and uploads only its public key and passphrase-wrapped private identity. Your passphrase never leaves the browser. The raw backup works with the age CLI and can decrypt without the passphrase, so protect it carefully. The service cannot recover a lost identity.

Create your first asset

1. Select New Asset.
2. Give it a name, such as Service account.
3. Enter a secret in the Secret field.
4. Select Create Asset.

The asset appears in the dashboard. You are its Custodian. Its secret is encrypted to your identity and, if enabled, the team owner's escrow identity. Asset names, websites, instructions, and attachment metadata are not encrypted; keep confidential information in secrets or file contents.

View and lock

1. Open the asset and select View Secret.
2. Close the secret dialog when finished.
3. Select Lock identity.

The asset list and metadata remain visible. Secret viewing and encrypted editing are disabled until you enter your personal passphrase under Unlock your vault identity. Unlock expires after 30 minutes and applies across your teams in that browser session. Unsaved secret drafts are not persisted.

Invite continuity partners

Invite team members from settings. Each person enrolls their own identity; nobody needs your passphrase or backup. Add enrolled Successors to the assets they may need and Gatekeepers to oversee access requests. Successors need approval before the server serves ciphertext, even though their keys are included in encryption in advance.

Continue with Team Management, Asset Management, Guardian System, and the Security Model.