Vault

Download for Windows

Security under one password

Passwords, 2FA codes, cards, documents and project values, encrypted on the computer before they are written. Unlocking once opens Vault for every Cosmic app on this computer until it locks again.

Vault unlocks, reveals and copies a password, then locks again.
VaultLockSearch VaultAll entries128NNorthwind Mailalex.rivera@northwind.exampleRRiverbankalex.riveraPPinewood ForumariveraAAtlas CardCard ending 4821HHome Wi-FiNoteSSprout deploysEnvironment, 6 valuesLLinden Libraryalex.rLLease contractDocument, PDFNNorthwind MailLoginEditUsernamealex.rivera@northwind.examplePasswordtide-Lantern-48-orbitOne-time code284 91318 sWebsitenorthwind.exampleCopied values clear from the clipboard after 30 seconds.Password copied. It clears in 30 seconds.

AES-256-GCM

Each entry is sealed with a 256-bit key, on this computer.

One master password

Or Windows Hello on Windows. PBKDF2-SHA-256, 600,000 iterations.

Locks by itself

After 5 minutes idle, and when the last app closes.

Recovery key

Shown once, to print or save, for a lost master password.

For users, for developers

An app asks Vault for its own kind of entry, and the rest stays locked. Access is revoked from Apps at any time.

For users

Passwords come in from the files Chrome, Edge, Firefox, Bitwarden, 1Password and KeePass export. Horizon fills website logins for the site that is open; anywhere else, copy from Vault and the clipboard clears after 30 seconds.

The exported file holds every password in plain text. Vault never deletes it on its own: it says where it is and asks.

Passwords are imported into Vault from a Chrome export.
VaultLockImportDone212 passwords imported6 rows were skipped.Skipped and why4Already in Vault, with the same website and username2Not a valid web addressDelete Chrome Passwords.csv nowIt holds every password in plain text. Vault did not move or delete it.Show in folder
A coding agent's commands receive approval in Vault and return masked output.
VaultLockSearch VaultAll entries128NNorthwind Mailalex.rivera@northwind.exampleRRiverbankalex.riveraPPinewood ForumariveraAAtlas CardCard ending 4821HHome Wi-FiNoteNNorthwind MailLoginEditUsernamealex.rivera@northwind.examplePassword••••••••••••••One-time code284 91318 sWebsitenorthwind.exampleCopied values clear from the clipboard after 30 seconds.claude$ vault run --project sprout --agent claude-code -- npx prisma migrate deployWaiting for approval in Vault.Approved for 2 commands.Datasource "db": PostgreSQL database "sprout" at "••••••••"3 migrations applied.

For developers

A coding agent asks Vault to run a command with a project's values. Vault shows the commands and waits; the values reach those commands only, and what they print comes back masked. Nova reads the values of the open project.

An approval covers that batch only, up to 10 commands, and expires after 10 minutes. The agent names itself when it asks, and a command, or a script it runs, can still save the values elsewhere.

Local. Free. Forever.

Vault keeps everything on this computer. It needs no account, and every kind of entry is included, for free.

  • No account
  • Stays on your computer
  • No limit on secrets

Two computers, one vault

Each computer writes its own encrypted changes into a folder already synced with a cloud service of the person's choice; only ciphertext travels. When the same entry changed on both, the newest wins and the other is kept.

A login travels encrypted through a cloud folder to another computer.
Your cloud folderEncrypted packages onlyYour computerVaultLockSearch VaultAll entries129NNorthside Gymalex.riveraNNorthwind Mailalex.rivera@northwind.exampleRRiverbankalex.riveraPPinewood ForumariveraAAtlas CardCard ending 4821HHome Wi-FiNoteSSprout deploysEnvironment, 6 valuesLLinden Libraryalex.rNNorthside GymLoginEditUsernamealex.riveraPassword••••••••••••••Websitenorthside-gym.exampleCopied values clear from the clipboard after 30 seconds.Your other computerVaultLockSearch VaultAll entries129NNorthside Gymalex.riveraNNorthwind Mailalex.rivera@northwind.exampleRRiverbankalex.riveraPPinewood ForumariveraAAtlas CardCard ending 4821HHome Wi-FiNoteSSprout deploysEnvironment, 6 valuesLLinden Libraryalex.rChoose an entry to see it.

Sync through Cosmic's own cloud comes at Release with Horizon Sync or Nebula+.

Get Vault

Free and local, for Windows 10 and 11, 64-bit.

Download for Windows
Source code on GitHub

Apache-2.0. The service and its command line are in the repository.