The vault

The vault is the encrypted file where Vaulterm keeps everything you save. It’s opened with your master password, or your Recovery Key, and nothing in it can be read without one of them.

What’s in the vault

In the vault (encrypted)	Not in the vault (preferences for this computer)
Hosts, including their hostnames, ports and tags	Your name for the greeting
Groups and their settings	App theme, accent and terminal theme
Identities and saved passwords	Font, size and background opacity
SSH keys (private halves)	Keyboard shortcuts
Snippets	Update channel
Tunnels	Command Center ranking (ids only)
Connections, with their passwords and S3 secret keys
Saved layouts, and the tabs you had open	Home’s stats (counts only)
Trusted host keys
Connection history for Home’s Recent and Most used lists (Most connected in v1 · Original)

The vault is one file, vault.db, in Vaulterm’s data folder: ~/Library/Application Support/Vaulterm on a Mac, ~/.config/Vaulterm on Linux, %APPDATA%\Vaulterm on Windows.

Lock Vaulterm

Press Lock Vaulterm at the bottom of the left rail, or choose Lock Vaulterm in the Command Center. Vaulterm shows Unlock Vaulterm until you type your Master password again.

While Vaulterm is locked:

• Your terminals and the Files tray are hidden, and nothing you type reaches them.
• Sessions that were open keep running on their servers, and are there as you left them when you unlock.
• Nothing new can connect, open a terminal or use files until you unlock: “Unlock Vaulterm to connect.”
• An import you were part way through is dropped, along with the keys it had read.

When you unlock, everything is where it was.

Auto-lock

Vaulterm locks itself:

• after a time without you touching Vaulterm (typing, clicking, scrolling or moving the pointer in its window), 15 minutes unless you change it, and
• straight away when your computer goes to sleep or you lock your screen, unless you turn that off.

“Touching Vaulterm” is measured inside Vaulterm, not across your whole computer: working in another app counts as idle.

Choose both in Settings → Security, or when you set up the vault:

• Lock Vaulterm after: 1, 5, 15 or 30 minutes, 1 hour, 4 hours, or Never. Never asks first: “Vaulterm won’t lock by itself. Anyone at this computer while it’s open can see your hosts, passwords and keys.” Press Never lock to keep it.
• Lock when this computer sleeps or its screen locks: turning it off asks first, and Keep it open confirms.
• Lock now locks straight away.

Change your master password

This version has no separate screen for it. Use your Recovery Key:

1. Press Lock Vaulterm.
2. On Unlock Vaulterm, press Forgot your password? Use your Recovery Key.
3. Enter your Recovery Key and press Unlock.
4. On Set a new master password, choose the new password, confirm it, and press Set password.

The rules for the new password are the same as the first one: at least 8 characters, typed twice. Your Recovery Key stays the same.

If you forget your password

Follow the same steps as above: the Recovery Key opens the vault and lets you set a new password. See If you forget your password.

If you’ve lost both the password and the Recovery Key, the vault can’t be opened. Not by you, and not by anyone at Vaulterm. Your servers aren’t affected; only what was saved in Vaulterm is out of reach. To start again, quit Vaulterm, move vault.db out of the data folder, and open Vaulterm: it sets up a new vault.

Back up the vault

Copy vault.db somewhere safe, with Vaulterm closed. A backup is as safe as the password that opens it, and opens with the password (or Recovery Key) you had when you made it.

To restore, quit Vaulterm and put the backup in place of vault.db.

Vaulterm checks each record against a sealed list of what the vault should contain as it reads it. If the file was damaged or edited outside Vaulterm, Vaulterm says “Your vault file is damaged or was modified outside Vaulterm. Restore it from a backup.” instead of using it.

How it’s protected

• Your master password is turned into an encryption key with Argon2, which is slow to compute on purpose, so guessing passwords against a stolen vault.db is slow too.
• Every record is encrypted with XChaCha20, and each one is sealed to its place in the vault, so records can’t be swapped, rolled back or removed without the vault noticing.
• Hostnames, names and other details are encrypted along with everything else. Someone with the file can’t tell which servers you use.
• Private keys and saved passwords stay inside Vaulterm’s core, the part that makes connections. The window you see never has them, and they’re never written anywhere else.

More detail is on the Security page.

Good to know

• There’s no account, and no copy of your vault or password anywhere else. Vaulterm doesn’t send it anywhere.
• Locking is instant. Unlocking takes a moment, since deriving the key from your password is slow on purpose.