Sign-in security: master password, TOTP, and sessions
VaultPilot signs you in with a username, your master password and, once you enable it, a six-digit code from an authenticator app. On the Sign-in security tab you change the master password, set up or revoke two-step verification and, as Owner, end other sessions.
- Master password
- At least 14 characters
- Second step
- TOTP app code
- Automatic lock
- Fixed at 15 minutes
- Session list
- Owner only
Setting up two-step verification
Start 2FA setup creates a TOTP secret in the browser and shows it as a QR code and a manual key. You add it to your authenticator app and confirm with the current six-digit code. The browser and the server both check that code before setup is saved.
Changing the master password
The change needs your current password and a new one of at least 14 characters. The browser re-encrypts your profile private key, and the TOTP copy when it exists, under the new password. The server stores the new verifier and encrypted material and closes your other sessions.
Active sessions for the Owner
The Owner sees the organization's non-expired sessions in a list that refreshes on its own. Each row shows a short session ID, user, role, last seen, expiry and whether it is the current session. Revoke ends another session at once, without a second confirmation.
Locking and recovery
The vault locks after 15 minutes without browser activity, and that time cannot be changed. There is no emailed password reset, SMS code, recovery code or identity-provider redirect. When sign-in keeps failing, the lock screen first asks you to check the master password, Caps Lock and the TOTP code, then points persistent server or profile failures to a VaultPilot Backup Tool restore.
If you get 401 right after sign-in
After sign-in, VaultPilot confirms the session with the server before it treats the vault as unlocked. If the server keeps rejecting the session right after login, the cause is usually a blocked cookie, a different host name, or a proxy that changes host, scheme or cookie behavior.
Limits to know
- This tab cannot reset another user's 2FA; the founding Owner does that on the Users screen.
- There is no failed-sign-in lockout policy and no trusted-device list.
- Auditor can see the forms, but the server rejects its password and 2FA changes.
- A read-only license blocks password and 2FA changes, even though the controls stay enabled.
Check step by step
Read more in the guides: Sign-in security screen, Session 401 after login