Vault records: passwords, keys, notes, certificates, and files
The browser encrypts each record before it is saved. The list shows each record's name, type, and lifecycle details. The secret value stays masked until someone with access opens it.
- Record types
- Six secret types
- Default view
- Values masked
- Storage
- Encrypted in the browser
- Outside lookups
- Only when you start them
Each record type has its own fields
Each type opens its own form with the fields below. In the unlocked browser, text search covers the decrypted title, username, URL, owner, and tags, never the password value.
Values open only when you ask
If you have access, you can reveal or copy a value, open the site address, or download a permitted file, but only when you choose to. Opening the site address does not sign you in. Each of these needs an unlocked vault, and your role and vault access decide what you may do.
Password generator and HIBP breach check
The generator defaults to 24 characters, and you can choose from 12 to 64. The value comes from the browser's cryptographic randomness and reaches the vault only when you select Save. The breach check runs only when you start it: the browser sends HIBP only a short prefix of the password's hash. Neither the password nor the full hash is sent.
VirusTotal lookup by file hash
The VirusTotal lookup on the Files screen does not upload the file. It opens the VirusTotal page for the file's SHA-256 digest in a new tab. That sends the digest to a third party. If your policy forbids that, do not use the lookup.
What Quick Recovery leaves out
A Quick Recovery package leaves out file records, record history, audit history, the license, and server settings. A full backup, taken on the Windows server with the Backup Tool, covers more.
Limits to know
- A Not found breach result does not show that a password is hard to guess or unique.
- Saving a record or generating a password does not change the account in the target system.
- VaultPilot does not scan files for malware. The VirusTotal lookup only queries the hash.
- A masked list does not protect a browser left unattended with the vault unlocked.
Step-by-step checks
Read more in the guides: Passwords screen guide, New item screen guide, Files screen guide, Backups and restore
See VaultPilot in your own environment
Tell us what the evaluation should cover, or open the live demo with sample data first.