Sign-in security: master password, TOTP, and sessions
VaultPilot signs you in with your username and master password, plus a six-digit authenticator-app code once you turn on two-step verification. On the Sign-in security tab, you change the master password, set up or revoke 2FA, and, as Owner, end other sessions.
- Master password
- At least 14 characters
- Second step
- TOTP app code
- Automatic lock
- Fixed at 15 minutes
- Session list
- Owner only
Setting up two-step verification
Start 2FA setup creates a TOTP secret in the browser and shows it as a QR code and a manual key. You add it to your authenticator app and confirm with the current six-digit code. The browser and the server both check that code before setup is saved.
Changing the master password
The change needs your current password and a new one of at least 14 characters. The browser re-encrypts your profile private key, and the TOTP copy when it exists, under the new password. The server stores the new verifier and encrypted material and closes your other sessions.
Active sessions for the Owner
The Owner sees the organization's non-expired sessions in a list that refreshes on its own. Each row shows a short session ID, user, role, last seen, expiry, and whether it is the current session. Revoke ends another session at once, without a second confirmation.
Locking and recovery
The vault locks after 15 minutes without browser activity, and that time cannot be changed. There is no emailed password reset, SMS code, recovery code, or identity-provider redirect. When sign-in keeps failing, the lock screen first asks you to check the master password, Caps Lock, and the TOTP code, then points persistent server or profile failures to a VaultPilot Backup Tool restore.
If you get a 401 error right after sign-in
After sign-in, VaultPilot confirms the session with the server before it treats the vault as unlocked. If the server keeps rejecting the session right after login, the cause is usually a blocked cookie, a different host name, or a proxy that changes host, scheme, or cookie behavior.
Limits to know
- This tab cannot reset another user's 2FA; the founding Owner does that on the Users screen.
- There is no failed-sign-in lockout policy and no trusted-device list.
- An Auditor can see the forms, but the server rejects their password and 2FA changes.
- A read-only license blocks password and 2FA changes, even though the controls stay enabled.
Step-by-step checks
Read more in the guides: Sign-in security screen, Session 401 after login
See VaultPilot in your own environment
Tell us what the evaluation should cover, or open the live demo with sample data first.