Your password vault on this device

Your vault keeps the passwords and SSH keys of your saved hosts in your account, end-to-end encrypted with your account password. The server only stores scrambled data it can't read. Any of your devices can use what's in it once you unlock it there. The vault is part of Pro.

Where to find it

On the Connections page, open the Vault tab (it used to be called Keys & passwords).

When you're signed in, the page is locked at first and shows nothing that's in it. Click Unlock, type your RemoteAccessApp account password and, if your account has two-step verification, the code from your authenticator app (or a backup code) in the same window. Pick how long it stays open on this device. Without Pro you open the page the same way: you see what's saved on this device, and the vault's parts carry a PRO label.

At the top of the page is your security summary:

• whether your vault is locked or unlocked, and until when, with Keep unlocked to change the time and Lock now;
• how many passwords and keys are in your vault and how many are on this device only;
• when your account password last unlocked it on this device;
• whether two-step verification is on for your account (if it's off, Turn on takes you to Settings).

Below it are Passwords, SSH keys and Trusted servers. Every password and key shows where it's kept:

• Vault: in your vault, so your other devices can use it.
• This device: saved on this device only (encrypted for you).
• Both pills: in your vault, with a copy here too.

The Vault chip at the top right of Connections shows the same thing: Vault locked · Unlock, or Vault unlocked until a time · Lock now.

Unlock it on this device

Click Unlock, type your RemoteAccessApp account password (and your two-step code when you're asked), and choose how long it stays unlocked here:

• Until I close the app (the first time): nothing is kept on disk, so it's locked again next time you open the app.
• 24 hours, 48 hours or 7 days: it stays unlocked across restarts until then. The time is shown on the card and the chip.

You can Lock now at any time. Locking removes the vault's key from this device straight away and locks the Vault page too. Passwords saved on this device keep working; ones that are only in your vault need the vault unlocked again.

On the Vault page, Keep unlocked changes the time. A shorter time applies straight away. A longer one asks for your account password (and code) first.

If you sign in to the app with your password, the vault unlocks for as long as you chose last time (until you close the app, if you never chose). The Vault page still asks for your password before it shows what's in it.

SSH keys

Each key shows its type, fingerprint and which saved hosts sign in with it (point at Used by to see them all).

• In vault: turn it on to keep the key in your vault, so your other devices and the website can use it. If the vault is locked, you unlock it first. Turn it off to keep the key on this device only: you're asked first. If hosts in your vault sign in with that key, they stay on this device with it. A key that's only in your vault is copied to this device first, and its hosts switch to the copy.
• Copy public key (the copy button) puts the public half on the clipboard, for a server's ~/.ssh/authorized_keys.
• The … menu has Export public key… (saves a .pub file), Replace key (a new key, a key file or a pasted key: it shows the new public key, then switches the hosts that used the old key once you've added it to those servers), Rename, and Delete.
• New key makes a new Ed25519 key on this device. Import file… and Paste key… bring in one you have.

Trusted servers

These are the server keys you confirmed when you first connected. Forget one (or Forget all…) and its fingerprint is shown again for you to check next time you connect. A changed server key is never trusted without asking you.

Connect with a password from your vault

Connect as usual. If the host's password is in your vault and the vault is locked here, you're asked for your account password to unlock it, then the connection carries on. Tick Also save this password on this device to keep a copy here, so it works while the vault is locked. Prefer to type the host's password? Choose Type the password instead.

While the vault is unlocked, its passwords are filled in for you. They're used for that connection only and are never copied onto this device unless you choose to.

Save a password

When you connect to a saved host that has no password saved, pick where to save the one you type:

• Don't save: used for this connection only.
• In my vault: end-to-end encrypted in your account. If your vault is locked, you unlock it first.
• On this device: saved encrypted on this device only, never in your vault.

You can also choose in the host's Saved section when you edit it, or right-click the host and open Saved. On the Vault page, each password has Change…, Move to vault, Save on this device, Keep on this device only and Delete (it asks first and says where it's deleted from). Hosts kept On this PC only keep their password on this device too.

A web panel's saved password goes in your vault when you right-click the panel, open Saved and pick Password in vault. After that, changing or forgetting it on this device updates your vault too. A panel whose password is in your vault from another device fills in and copies from your vault here too, without being saved on this device. Hosts a team shares with you never go in your vault.

On the website: unlock once for changes

On the website, removing hosts and changing how a host signs in are protected, so someone who gets into your account can't delete your servers or point them somewhere else. This covers removing one or many hosts or web panels, changing a host's address, port, user name, password or SSH key (or which key it uses), your saved SSH keys, and turning on Never save passwords. Adding hosts, renaming them and moving them between groups need nothing.

The first time you do one of these, you're asked to confirm it's you:

1. Type your RemoteAccessApp account password.
2. If you have two-factor authentication on, type the code from your authenticator app (a backup code works too). You're asked for it every time you unlock, even right after signing in.
3. Choose how long to stay unlocked: Until I close the browser, 24 hours, 48 hours or 7 days.

Until then you can make those changes without your password or a code. With Pro, the same step unlocks your vault, so your saved passwords and SSH keys work in the browser terminal too. Lock now, on the card at the top of Hosts, locks it straight away. Signing out locks it too.

Without two-factor authentication, your password alone unlocks it. Turning two-factor on in Security means a stolen password isn't enough.

If you open one of the website's public pages (the home page, say), the browser forgets your vault's key to keep it away from the scripts those pages run. Your hosts stay unlocked for changes; using a saved password again just needs your account password, no code.

Without Pro

Everything to do with the vault carries a PRO label. Choosing it shows what Pro adds and how to get it, and nothing changes. You can still open the Vault page (with your account password, as above). Passwords and SSH keys saved on this device keep working, and you can still change or delete them there.

Hosts and passwords you already have

Nothing moves by itself. Passwords already saved on a device stay there, and your vault keeps what it has. If your Windows app already had Upload saved SSH passwords to my account on, it stays unlocked and syncs exactly as before until you choose Lock now or a time limit.

How it's protected

• Your account password is never stored. Unlocking derives the vault's key from it on your device.
• Opening the vault or the Vault page checks your password with RemoteAccessApp the same way signing in does, including your two-step code and the limits on wrong tries. So it needs a connection to RemoteAccessApp, unless it's still open from earlier.
• Until I close the app keeps the key in memory only.
• For 24 hours, 48 hours or 7 days, a sealed copy is kept on this device until the time runs out. On Windows it's protected by Windows for your user account and never goes in a roaming profile. On Linux it's kept in your desktop's keyring (GNOME Keyring or KWallet) when there is one, otherwise a key file only your user can read. The copy only opens for your account, on this computer, and only before its time runs out. Setting the clock back locks it. It's deleted when the time runs out, when you lock the vault, when you sign out, and when another account signs in.
• SSH keys from your vault are held in memory while it's unlocked and go when the app closes. Only a vault kept unlocked on this PC the older way (before time limits) keeps a sealed copy of them on disk.
• To stop a lost or stolen device from using your vault, sign it out from the website (Security, sign out other devices). Without a working sign-in, the device can't fetch your vault, even while it's unlocked.

If something goes wrong

• "That isn't your account password": type your RemoteAccessApp password (not the host's).
• "That code isn't right": type the newest code from your authenticator app, or one of your backup codes.
• "Too many tries": wait a minute, then try again.
• "Your vault was locked with an older account password": your password was changed on a device that couldn't update the vault. Unlock with the old password, or start over from Settings → Account.
• "Saving passwords is turned off for this account": an account owner turned on Never save passwords (website, Security). Nothing is saved anywhere while it's on.