New item screen

The New item editor opens from the global topbar Add new record control after you choose Password, API key, Secure note, Certificate, or File. A successful save creates the encrypted record in the currently active vault. The editor has no autosave, saved drafts, template picker, or automatic rotation action.

Access, active vault, and license boundary

The chooser and editor can open for an Auditor, but that does not grant write access. Saving requires an unlocked active vault. The signed-in user must be Owner, Admin, or User and have Editor or Manager access to that vault. Save is disabled for Auditor, vault Viewer, and read-only license states, and the server enforces the same rules itself.

The New item page has no vault picker. The record is written to the vault that was active when Save encrypted record was selected. Confirm the active vault elsewhere before entering sensitive material. Manual Password, API key, Secure note, Certificate, and File records need no separate license feature beyond a writable license.

Supported manual record types

The type rail offers five types:

Active Directory credentials are absent from the type rail. New Active Directory credential records come from agent sync. If manual creation is attempted, the form refuses it and points to Integrations > Active Directory.

There is no general Owner or Tags control on this form. The account field is context for the type, not a guaranteed owner field. Certificate authority selection adds fixed certificate tags; other tags are not edited here.

What you can do here

• Select one of the five manual record types before entering its required value.
• Enter a clear title and only the context fields needed to find and use the record safely.
• Generate or paste a value, then use the optional breach check when it is offered and your policy permits it.
• For Certificate, add leaf, chain/intermediate, private-key, and PFX/P12 sources through separate controls; for File, select one file within the limits.
• Review the active vault and your write access before selecting Save encrypted record.
• Use the back arrow to discard the current form and return to the list for the selected type.

Type changes and sensitive data boundaries

Certificate, Credential, and File are handled separately from other types. When switching into or out of one of them while the form holds a hidden value, certificate or private-key material, a file, or a directory link, VaultPilot asks for confirmation. It then clears those sensitive fields and any source passphrases, so nothing hidden carries over into a later record. General context such as title, account, URL, note, category, environment, owner, and tags may remain.

Password, API key, and Secure note can keep the entered value when switching between them. Recheck the visible type and value before Save. Cancelling the confirmation leaves the current draft unchanged.

Value generation, strength, and breach check

The password generator is available for every manual type except File. Lowercase letters are always used; Uppercase, Digits, and Symbols add their characters to the mix. The result is not guaranteed to contain a character from every selected set. The length control allows 12–64 characters and defaults to 24 with all three options on. Generation uses the browser’s secure random generator and replaces the current hidden value; it does not save the record.

The Short / Ready / Strong pill judges length only: under 16, 16–23, or 24+ characters. It is not a policy check, breach result, or save requirement.

When the breach button is present, it runs only when you select it. The browser sends only the first five characters of a SHA-1 hash of the value to the Have I Been Pwned service; the value itself never leaves the browser. The shown result is not tied to the current value: generating, pasting, or editing afterwards can leave an old result visible, and that result can be kept with the saved record. Finish the value first, then run the breach check again right before Save. A breach-check error does not save or change the record.

Certificate handling

The certificate editor has four source roles: Leaf certificate, Chain / intermediate, Private key, and PFX / P12. Several sources can be added to a role, and a wrong or old source can be removed without affecting the others. PEM, CRT, CER, DER, P7/P7B/P7C/CMS, PFX/P12/PKCS12, P8/P8E/PK8, PKCS#1, PKCS#8, and KEY are supported; one record accepts at most 16 sources and 10 MB in total.

The browser calculates a SHA-256 for each source and reads it fully. It reads X.509 certificates and PKCS#7 chains, opens PFX/P12 packages, and recognizes RSA, EC, and Ed25519-family keys. When a private key is present, it is checked against the leaf certificate. Save is blocked until at least one valid X.509 certificate exists, the key matches, protected sources can be opened, and all limits pass. The original files are stored only inside the encrypted record; cards do not show, copy, or download them.

Each protected PFX/P12 or private-key source has its own Source passphrase. Store passphrase encrypted in this vault is off by default. Even when on, VaultPilot keeps only a passphrase that actually opened a source. With the option off, the passphrase stays only in the browser for validation and is cleared on lock, logout, user change, or vault change.

Expiry and Subject/CN can be corrected in the form. Selecting DigiCert, GoDaddy, GlobalSign, Let’s Encrypt, Microsoft CA, or Self-signed changes only the record’s certificate category and tags. It does not contact that CA or order, renew, reissue, revoke, or deploy a certificate.

File handling and limits

A new File record requires one selected file. Selecting it switches the form to File, fills Title from the file name if Title is still blank, and shows the size. The password generator and hidden-value editor are not available for File.

Each user can store up to 1 GB of files in the active vault. On Save, the browser calculates the file’s SHA-256, creates the encrypted File record, then encrypts and uploads the file in parts. The server receives only encrypted data, never the file’s contents.

Creating the record and uploading the file are separate steps. If the upload fails after the record was created, nothing is undone automatically. Refresh Files and check the record before retrying or replacing it. An error notice does not prove that no record or partial upload exists.

Browser encryption, save, and audit outcome

For non-file records, the browser encrypts the whole form with the active vault key before sending it. The server checks your session, role, license, and vault access; it never receives the plaintext title, account, value, URL, note, or certificate material.

Before saving, the form checks in this order:

1. An active, unlocked vault exists.
2. The license and your vault role allow changes.
3. New Active Directory credentials are refused on this page.
4. Title is filled in for every type.
5. Password and API key have a value; Certificate has at least one valid X.509 certificate, and any added private key matches the leaf.
6. Secure note has note content or a hidden value.
7. A new File has a file selected, and it keeps you within the 1 GB limit.

These checks help you fill in the form; access protection happens on the server, which checks the session, license, and vault role again.

While a certificate import, encryption, save, or file upload is running, Save is disabled and progress is shown. There is no cancel button for a running save or upload.

After a successful save, the audit history records the new record; certificates and files are recorded as imports. The form resets, the matching record list opens, and the lists refresh. A success notice confirms encrypted storage only, not that a credential was tested, a certificate deployed, or a file opened successfully.

Cancellation and error behavior

• The back arrow resets the form and returns to the type’s list without asking about unsaved changes. It does not stop certificate reading, save, or upload work that has already started. Do not navigate away to cancel; wait for completion or failure, then check the list and Audit Log.
• There is no separate Cancel button for a new record. Cancel edit appears only for an existing record; it ends edit mode and leaves a blank Password draft on the New item screen instead of returning to the list.
• Rejecting an oversized File clears the picker but can leave earlier file details in the form. If a certificate source is unreadable, its passphrase is wrong, or its key does not match, remove or replace that source and validate again; do not save until the editor reports a valid result.
• Most validation and save errors keep the form so you can correct it. A page reload, lock, or back-arrow reset does not keep a draft.
• A failed save shows an error on screen and in notifications. Do not paste the full error or form contents anywhere.
• A file upload can fail after the record is created; check Files and Audit Log before deciding whether to retry.

Recommended workflows

Create a Password, API key, or Secure note

1. Confirm the active vault and your Editor or Manager role.
2. Choose the exact type and enter Title.
3. Add the required value; for Secure note, add note content, a hidden value, or both.
4. Add only the necessary account, URL, and context.
5. Optionally generate a value. After the final value is set, run the breach check right before Save; neither action saves automatically.
6. Select Save encrypted record, wait for completion, and confirm the expected list and audit entry.

Import a certificate record

1. Choose Certificate and enter a non-sensitive title.
2. Add leaf, chain/intermediate, private-key, and PFX/P12 material to the correct source roles; enter a separate passphrase for every protected source.
3. Review X.509 reading, private-key match, chain state, SHA-256 values, Subject/issuer, and validity. Do not keep source passphrases unless your process requires it.
4. Select Save and confirm the import in the audit history. Certificate cards show details, fingerprints, and chain-bundle or PFX export actions, not the raw material or original file.
5. Use the Certificates screen for inventory review and Server settings for the VaultPilot HTTPS certificate; this page does not deploy it.

Store a file

1. Confirm your remaining file storage in the vault and choose a file no larger than 1 GB.
2. Review the suggested title, file name, size, and destination vault.
3. Save and keep the page open while hashing, encryption, and upload finish.
4. Open Files and confirm the record can be downloaded before treating the upload as complete.
5. If an error occurred, check Files and Audit Log for a created record or partial upload before retrying.

Screen states

Before you act

• Confirm the active vault; this page has no vault picker.
• Confirm a writable license and Editor or Manager access to that vault.
• Use Active Directory sync, not New item, for new RDP/SSH credential records.
• Choose the type before entering sensitive material. After certificate, file, or tag work, reset and reopen instead of relying on a type switch; otherwise recheck hidden data.
• For certificates and files, confirm you may store them, their classification, retention, size, and destination.
• Generate, breach check, certificate import, and CA selection do not save or deploy anything. Re-run the breach check after the final value change and right before Save.

Safe evidence

• Safe to share: selected type, general validation state, size range, the audit action, and a field list with placeholder values.
• Keep private: title, account, URL, note, owner or team, certificate subject, issuer, serial and hash, file name, exact size, and internal system or ticket references.
• Never share: passwords, API keys, tokens, certificate or private-key material, PFX/P12 contents or passwords, file contents, encrypted data, vault keys, or full form screenshots.
• If a real value was shared anywhere, treat it as exposed and rotate or revoke it in the system it belongs to.

When to stop and escalate

Stop when the active vault is uncertain, write access is unexpected, the origin of a certificate or file is unknown, private-key exposure is suspected, an upload fails partway, the storage figure conflicts with the screen, or audit and list outcomes disagree. Email support@vaultpilot.io with the record type, broad size, error message, broad time window, and last safe step, without secret material.

Operator notes

New item is an in-browser encryption form, not a workflow engine. It does not autosave, keep drafts across reloads, test credentials, create Active Directory records manually, decide certificate trust, deploy certificates, scan files, or rotate external systems. Reading a certificate and matching its key do not mean your organization trusts it.

Related

• Passwords screen
• API keys screen
• Secure notes screen
• Certificates screen
• Files screen
• Active Directory records screen
• Audit Log screen

Back to Documentation →