Your first entry
An entry is one thing you want to keep: a login, an API key, a card, a server. Each entry has a type, a title and a set of fields. Every field has a tier, and the tier decides who can read it.
Create the entry
1. Unlock your vault. It opens on Entries.
2. Click + New entry and pick a type.
3. Fill in the Title and the fields you need. Types that carry web addresses also have a URLs box, one address per line.
4. Click Save.
The types are Login, API Key, Card, Identity, Note, SSH Key, TOTP, Software License, Database, Wi-Fi, Server, Crypto Wallet and Custom. Each type comes with its own fields. A Login, for example, has Username, Password, TOTP, URLs and Notes.
Tiers: who can read a field
Fields that hold secrets carry a badge next to their label: L2 or L3. A field without a badge is L1.
| Tier | What it means |
|---|---|
| L1 | Not encrypted by your browser. Titles, usernames, URLs and similar fields that search and display need. |
| L2 | Encrypted in your browser before it is sent. Clients you enroll, such as the CLI, can decrypt it on their own machine. Passwords, API keys and notes are L2 by default. |
| L3 | Encrypted in your browser with a key that only your unlock device can produce. Agents can never read it. Card numbers, CVV, passport and social security numbers, private keys and seed phrases are L3 by default. |
The vault server stores L2 and L3 values as ciphertext. It cannot read them.
Add your own fields
Under Additional fields, click + Add field. Give the field a label, a value, and a tier: L1 plaintext, L2 encrypted or L3 hardware. Pick L3 for anything an agent should never see, and L2 for anything an agent needs.
Working with a saved entry
Click an entry to open it. Secret values are masked until you click show, and copy copies a value without showing it. From the entry you can also:
- Edit it. Every save is a new revision, and nothing is overwritten. See version history.
- Open its History.
- Change its Scopes (click edit next to Scopes). Scopes decide which agents can reach the entry. An entry with no scope is visible only to you and to clients with full read access.
- Copy without secrets: copies the title, URLs and plain fields as JSON, for pasting into another vault's import.
- Delete it. A delete is a final revision, not an erase. See deleting and tombstones.