User Guide

Getting Started

Valid Vault keeps everything on your own device, encrypted. There is no account, no server, and no company holding a copy. That also means nobody can reset your access for you, so the few minutes you spend on setup and backups matter.

How the vault is locked

When you set up Valid Vault, it creates one random 256-bit master key. That key encrypts your logins, notes, wallets, and bookmarks. The key itself is never saved as is. Each unlock method you set up (fingerprint or device PIN, and optionally a password) holds its own locked copy of it. Unlocking is the act of opening one of those copies. A wrong fingerprint, PIN, or password simply fails to open it. There is no stored password hash anywhere for anyone to test guesses against.

First setup

1. Open the popup by clicking the Valid Vault icon in your browser toolbar. Pin it to the toolbar so it is always one click away.
2. Enroll Fingerprint / PIN. This uses Windows Hello, which covers your fingerprint reader and your Windows device PIN. This is the recommended method. The next section explains why.
3. Add a password only if you want one. It is optional. If you add it, it needs 12 or more characters with a letter, a number, and a symbol, and longer is much better.
4. Finish & Unlock. You need at least one unlock method.
5. Back up your key right away. In the menu, open Settings Menu, then Sync, and use Export Key. Store that file as described in Backups and Cold Storage. Do this before you save anything important.
6. Pick your timers in Settings using Setups for Different Users as a starting point.

Fingerprint, PIN, or Password

Valid Vault gives you the choice. Here is how each method protects you, so you can choose with your eyes open.

The risk with a password

Your encrypted vault is stored in your browser's profile on disk. A password-locked copy of your master key is stored there too. If someone ever copies your browser profile (malware, a stolen laptop without disk encryption, a backup that leaks), they can take that copy to their own hardware and guess passwords as fast as their machines allow, with no lockout and no limit on attempts.

• Valid Vault stretches every password guess through 600,000 rounds of PBKDF2, which makes each guess slow and expensive. A long, random password holds up against that for longer than anyone will ever try.
• A short, reused, or predictable password does not. The stretching buys time; it cannot rescue a weak password.
• A typed password can also be seen. Someone watching your keyboard, a hidden camera, or a keylogger can capture it.

How fingerprint and device PIN avoid that

When you enroll fingerprint or device PIN, the secret that unlocks your master key lives inside Windows Hello, backed by the security chip in your computer. It never leaves that chip and is never written to your browser profile.

• Nothing on disk can be guessed at. A copied browser profile contains a locked key with no way to test guesses against it.
• Guessing the device PIN is capped. Windows limits wrong PIN attempts and locks out repeated guessing, so a 4 to 6 digit PIN stays safe in a way a 6 character password never could.
• Nothing to shoulder surf or keylog when you use your fingerprint.
• It is fast, which makes short auto-lock times painless. That is a big part of staying safe day to day.

Which to choose

• Have a fingerprint reader: use fingerprint. It is the strongest and the most convenient.
• No fingerprint reader: use your device PIN through the same Fingerprint / PIN option. It is still stronger than a password, for the reasons above.
• Want a password as a backup unlock: that is your choice. Make it a long passphrase you use nowhere else, such as four or more random words with a number and a symbol. Understand that it adds a copy of your key on disk that can be guessed at offline.
• Password only: supported, for devices without Windows Hello. Use the longest passphrase you can comfortably type.

Changing methods later

In Settings Menu, Manage, the Unlock Methods cards let you enroll, re-enroll, or delete each method. You always keep at least one: fingerprint cannot be deleted without a password in place, and the password cannot be deleted without fingerprint in place.

Locking and Timers

What locking does

While unlocked, your master key sits only in the browser's memory. Locking erases it from memory everywhere at once: the popup, every open Manage page, the bookmarks panel, and autofill on every tab. After a lock, nothing can be read until you unlock again. Closing the browser always locks.

You can lock by hand at any time with the padlock in the popup, and the vault locks itself through the auto-lock timer.

What stays protected while unlocked

Unlocked means autofill is ready to use. The vault itself stays closed to anyone who sits down at your computer. Even while unlocked:

• Viewing anything in Manage (logins, Misc Credentials, Personal Info, Crypto Wallets) asks for your fingerprint, PIN, or password again, section by section.
• Changing your unlock methods or clearing the vault asks for your fingerprint, PIN, or password again.
• Exporting, importing, or sharing your key or vault, by file or QR, asks for your fingerprint, PIN, or password first. A brand-new browser with no vault yet skips this, so first setup still works.
• Passwords are never shown in the popup and never copied to the clipboard. Autofill places a password straight into the field you clicked.
• Anything that leaves the device stays locked. A shared or exported vault is encrypted under your master key, and your key only travels under your passphrase and three answers.

What an unlocked vault does allow is autofill itself: someone at your computer could use the V tags to sign in to your sites on that computer, and could browse your bookmarks list. The auto-lock timer is what closes that window.

Auto-lock timeout

Settings, Auto-lock timeout (seconds), from 10 seconds up to 2 hours. The readout next to the box shows the time as hours, minutes, and seconds.

• What it measures: idle time. Every real mouse movement, scroll, click, or key press, on any website or Valid Vault page, resets the clock.
• Only real input counts. A web page cannot fake activity to keep your vault open. Reading a long article without touching the mouse counts as idle.
• When it runs out: the vault locks within a few seconds, exactly as if you had pressed the padlock.
• Sleep and hibernate: if the computer sleeps past your timeout, the vault is locked when it wakes.
• Crypto Wallets follows this same timer and closes itself when it runs out, in addition to closing whenever you switch tabs.

QR stream timeout

Settings, QR stream timeout (seconds), from 5 seconds to 10 minutes. This is how long a Share Vault or Share Master Key QR code stays on screen before it closes itself. You can always close it sooner.

• Shorter is safer: less time on screen means less chance of it being photographed or left open.
• Longer helps slow scans: a weak camera or dim light may need more time.
• Recommended: 30 to 60 seconds at home, 15 seconds or less anywhere public. If a scan keeps timing out, raise it for that one transfer, then set it back.

Autofill

Valid Vault never fills anything without your click. Fields it recognizes get a small V tag at their edge.

• Green V on a login, email, or password field: click it to pick one of your saved logins for this site. Picking a login fills the username and password together.
• Inverted V (black circle, green V) on a new password field: click it, choose a style, and it generates a strong password. It fills both the new password and the confirm box, masked.
• Personal info fields (name, phone, address, email) get a V that fills from your Personal Info profile.
• Locked? Clicking a V while locked opens a small Valid Vault window to unlock with fingerprint, PIN, or password. Your unlock never happens inside the website itself.

Saving logins

When you sign up or log in, Valid Vault offers to save the login, or to update it if the password changed. It follows through sign-in redirects and multi-step logins. If you were locked, the prompt offers Unlock and Save.

Changing a password on a site

1. On the site's change password form, click the green V on the current password field to fill your saved password.
2. Click the inverted V on the new password field to generate a new one. Both boxes fill.
3. Submit the form, then choose Update on the save prompt.

Previous password safety net

Sometimes a site shows success but never actually saves the new password. To protect you, Valid Vault keeps the old password as a labeled Previous passwords choice in the login picker, with the date it was replaced. Picking it restores it.

The old password is removed only after the new one has been used 3 times and 14 days have passed. Both must happen, so a password you use once and then forget about is never dropped too early.

Password Generator

Generated passwords come from your browser's cryptographic random source. When you click the inverted V, choose With special characters to include at least one uppercase letter, lowercase letter, digit, and symbol (! @ # $ % ^ & *), or Letters and numbers only for sites that reject symbols. Either way the characters are shuffled randomly, and Generate a different one keeps the style you picked.

What the length settings do

Settings, Password Generator. Each time you generate, the length is picked at random inside the range you choose, so your passwords are not all the same size.

Minimum (16 or 20) sets the low end of the 24 range. It only matters when the maximum is 24.

Why longer is not always better

• 16 random characters are already out of reach. That is about 100 bits of randomness, far beyond what any computer can guess.
• Some sites have hidden limits. A site may silently cut a long password short or quietly reject it. Your vault would then hold a password that does not match what the site stored. If a site declares its limits, Valid Vault always follows them. Hidden limits are the risk, and they are more common the longer you go.
• If a site rejects a generated password, click Generate a different one, or lower your maximum to 24 for that change.

Password Habits That Work

A password manager protects you because it makes one habit effortless: a different random password for every site. When a site is breached, the attacker gets that one password, and it opens nothing else.

• Let the generator make every password. Do not invent them. People are predictable; the generator is not.
• Never reuse a password, especially your email password. Your email can reset everything else.
• Change a password when the site reports a breach, using the steps in Autofill.
• Keep your master password and key passphrase out of the vault. They unlock the vault, so storing them inside it helps no one. Keep them in your head and on paper in cold storage.
• Turn on two-factor authentication on important accounts. It is your second line of defense if a password ever leaks.
• Lock before you walk away, even with a short timer.

What You Can Store

Every section lives inside the same encrypted vault. Each section in Manage asks for its own unlock before showing anything.

• Website Credentials: your logins, grouped by site, with more than one account per site. Saved as you browse.
• Misc Credentials: Wi-Fi passwords, license keys, recovery codes, and other secrets, by category.
• Personal Info: name, phone, address, and a ranked list of emails, used to fill signup and address forms.
• Crypto Wallets: seed phrases by wallet and account, checked word by word against the standard 2048-word list, completely offline. Words only appear while you choose to show them and disappear when you switch tabs or the window loses focus. They are never filled into web pages.
• Bookmarks: saved from the bookmark icon in the popup and listed in a searchable side panel from the menu. Unlike browser bookmarks, nothing about them is readable on disk.

Your Master Key

Your master key is what makes your vault readable. It only ever leaves a device inside a key package, locked under a passphrase plus three security questions you choose, and stretched through 1,000,000 rounds of PBKDF2. The Share Master Key QR code and the Export Key file both carry that same package.

Why a captured QR or stolen file is useless

• A captured vault QR is ciphertext. It cannot be read without your master key.
• A captured key QR or key file is locked. Opening it requires the passphrase and all three answers, and every guess costs a million rounds of stretching.
• Shoulder surfing the screen gets nothing usable. A photo of the QR code alone opens nothing.
• The one real gap: someone who captures the key QR and watches you type your passphrase and answers. So type them where nobody can see your keyboard or screen.

Choosing your passphrase and questions

You set these the first time you share or export your key. After that, sharing is one click. Change Key Passphrase in Sync replaces them.

• Passphrase: four or more random words plus a number and a symbol, like copper-lantern-mosaic-drift7!. Common passwords and simple variations are refused.
• Questions: pick three from the list of ten. Choose ones whose answers are not on your social media or public records.
• Answers: one word each, and capitalization matters. You can use a false answer you will remember, which is stronger than the true one.
• Write them down on paper and keep that paper somewhere separate from your key file. Nobody can recover them for you.

Naming your key

Settings, Master Key Name. The name appears in exported file names so you can tell backups apart. It is a label only and is never needed to import.

Uni-Vault on One Computer

Uni-Vault links every browser on this computer to one encrypted vault file. Save a login in Chrome and it shows up in Edge. Delete one in Edge and it disappears from Chrome. No exporting, no importing, no server.

How it works

• One file, many browsers. The vault file lives wherever you choose, such as your Documents folder. Every linked browser reads from it and writes to it.
• Each browser keeps a working copy. Autofill stays instant, and nothing is lost if the file is briefly unreachable.
• Changes travel on their own. A save reaches the file within about a second. Other browsers pick it up within a few seconds while Manage is open, within about 30 seconds otherwise, and every time they unlock.
• Same merge rules as always. The newest edit wins, and deleted items stay deleted everywhere.
• The file is encrypted. It is the same encrypted vault file Export Vault has always made, useless without your master key.

Setting it up

1. In your first browser: Settings Menu, Sync, Export Vault. Pick where the vault file should live, then choose Link this file.
2. In each other browser: install Valid Vault, complete first setup, and use Import Key with your key file so every browser holds the same master key.
3. Then Import Vault, pick that same vault file, and choose Link this file.
4. When the browser asks to let Valid Vault edit the file, allow it. If it offers Allow on every visit, choose that, and it will not ask again.

The Uni-Vault panel in Sync shows which file each browser is linked to and when it last synced.

Staying safe

• A bad file is refused, never trusted. If the file is damaged, replaced with something else, or made with a different master key, Valid Vault refuses it, leaves it untouched, and keeps working with its own copy. Sync shows exactly why.
• Moved or unreachable file: nothing is lost. Put it back, or use Unlink and then Import Vault to link the file in its new place.
• Permission asked again: if the browser ever forgets your permission, a Reconnect button appears in the popup and in Sync. One click and you are back in sync.
• Keep the file on this computer's own drive. A USB drive is for backups, since Uni-Vault stops syncing whenever the drive is unplugged.
• Keep your backups. Uni-Vault keeps one file on one disk, so keep exporting backups to cold storage as described in Backups and Cold Storage. When a browser is linked, Export Vault saves a separate backup copy and the link stays put.
• Unlink in Sync stops a browser from syncing. It keeps its own copy, and the file is not deleted.

Moving Between Browsers and Devices

Every browser and device that should share a vault needs the same master key. Always move the key first, then the vault. Merging only works between browsers that hold the same key.

Adding another browser on the same computer

A computer cannot scan its own screen, so use files. Linking the vault file sets up Uni-Vault, as described in Uni-Vault on One Computer.

1. In your current browser: Sync, Export Key and Export Vault.
2. Install Valid Vault in the new browser and complete first setup.
3. In the new browser: Sync, Import Key. Choose the key file and enter your passphrase and three answers.
4. Choose how the new browser unlocks the key. Fingerprint or device PIN is recommended; a master password is the fallback.
5. Sync, Import Vault, and choose the vault file. Choose Link this file to stay in sync automatically, or Merge once to copy it in one time.

Moving to another device with a camera (QR)

1. Somewhere private, on the old device: Sync, Share Master Key.
2. On the new device: Sync, tap the scan box, and point the camera at the QR code.
3. Enter the passphrase and three answers, then choose how the new device unlocks.
4. On the old device: Share Vault, and scan it on the new device.

Moving without QR

The file method works between any two devices: Export Key and Export Vault, carry the files on a USB drive, then Import Key and Import Vault on the other side. Crypto Wallets and bookmarks travel only inside the vault file, so use files whenever you need to move those.

Keeping browsers in step

• On one computer, Uni-Vault keeps every linked browser caught up on its own.
• Across devices, or in a browser without Uni-Vault, repeat Export Vault and Import Vault (Merge once) whenever you want it caught up. Your key only moves once.
• Merging is safe to repeat. For each item, the newest edit wins, and deleted items stay deleted on every browser. Importing the same file twice changes nothing.
• Importing a key on a browser that already has a different vault warns you first: that browser's old vault becomes unreadable and is cleared. This is how you prepare a browser to receive your real vault.

Backups and Cold Storage

Your vault exists only on your devices. Backups are how you survive a dead drive, a stolen laptop, or a reinstalled Windows.

The two files

Cold storage for your key

• Put the key file on a USB drive, ideally an encrypted one, and keep it unplugged and offline.
• Make two copies in two places, such as one at home and one with a trusted person or in a safe deposit box.
• Store the written passphrase and answers apart from the drive. Whoever finds one should not find the other.
• Never send the key file and the passphrase together, and avoid emailing or cloud-syncing the key file at all.
• Test your backup once: import the key file in a spare browser to confirm your passphrase and answers work.

Setups for Different Users

Starting points to tune from. Change any of them to fit how you work.

Troubleshooting

A field has no V tag.

Reload the page. Some sites build their forms in unusual ways, such as custom drop-downs or editable text areas that are not real input boxes, and those are not supported.

The vault locked while I was working.

Only real mouse, scroll, click, and key input counts as activity. Reading or watching without touching anything counts as idle. Raise the auto-lock timeout if it happens often.

Fingerprint / PIN is not offered.

Your device may not have Windows Hello set up, or it cannot tie keys to it. Set up Windows Hello in Windows Settings, then enroll again, or use a password.

Fingerprint stopped working after a Windows change.

Unlock with your password if you have one, then re-enroll fingerprint in Manage. Without a password, import your key file.

Sync says Uni-Vault is switched off in Brave.

Brave blocks the feature Uni-Vault needs. Follow the Brave steps in Uni-Vault on One Computer.

Uni-Vault says the vault file cannot be reached.

The file was moved, renamed, or is on a drive that is not plugged in. Put it back, or Unlink and link it again with Import Vault. Nothing in the browser is lost.

Import Vault says the vault was made with a different key.

Import the matching key first, then import the vault.

The QR scan stalls.

Brighten the screen, hold the camera steady and close enough that the code fills most of the view, and raise the QR stream timeout for that transfer. Files always work as an alternative.

A site rejected a generated password.

The site likely has a hidden rule. Click Generate a different one, or lower your maximum length to 24 for that change.

A site said my password changed, but the new one does not work.

Open the login picker and choose your password under Previous passwords.

Crypto Wallets closed by itself.

That is intended. It closes when you switch Manage tabs or browser tabs and when the auto-lock timer runs out, and its words hide whenever the window loses focus.

Honest Limits

• Malware: Valid Vault shuts out the common tricks. Passwords never touch the clipboard, unlocking happens in Valid Vault's own window, and web pages only ever receive the one value you clicked to fill. Malware that has taken full control of your computer can still watch what you do on screen, which no password manager can fully prevent. Keeping your system updated and locking when you finish keep that risk small.
• Someone at your unlocked computer can use autofill to sign in to your sites on that computer until the vault locks. They cannot view your logins, seed phrases, or personal info, change your unlock methods, or take a usable copy of your key without your fingerprint, PIN, or password. A short timer closes even that window.
• The phone app is catching up. The Android app is receiving the extension's newer features, including the protected key format, Personal Info, bookmarks, Crypto Wallets, and the password generator, in upcoming releases. Until then, this guide describes the browser extension.
• Unusual form fields, such as custom drop-downs and editable text areas, are not filled.