Secrets Vault
The vault stores logins, SSH keys, API keys, notes and other secrets, encrypted on the device before anything is written or synced. Open it from the lock icon (Vault) in the home screen’s top bar, or from Vault in the desktop sidebar.
A personal vault kept on one device is part of Free. Syncing the vault through a server, adding more devices to it and team vaults require PocketCmd Pro.
Set up the vault
Section titled “Set up the vault”The first time you open the vault, tap Create vault. If you have paired a PocketCmd Server, PocketCmd asks Where should your personal vault sync?:
| Choice | Behavior |
|---|---|
| A paired server | Encrypted sync through that server. You can enable more servers later. |
| This device only | No sync. The vault never leaves the device. |
With no paired server, the vault is created on this device only. If the vault already exists on another of your devices, this device joins it instead of creating a second one. Joining needs approval from that device; see Add another device.
A personal vault synced through a team server stays personal. The server stores it for your own devices, and no teammate can read it.
Item kinds
Section titled “Item kinds”| Kind | Fields | Action |
|---|---|---|
| Login | Username, password, website, one-time code secret (TOTP), notes | The item shows the current one-time code and when it refreshes |
| Password | Password, notes | |
| API Key | Key, URL, notes | |
| Secure Note | Note | |
| Custom Item | Fields you define | |
| Server | Host, port, username, password, private key, passphrase, notes | Add to servers |
| SSH Key | Private key, passphrase, notes | Import into key library |
| Snippet | Command, description, notes | Add to command library |
| Metric Command | Command, unit, interval, notes | Add to a dashboard… |
| Settings Profile | A snapshot of the app’s settings | Apply this settings profile |
Secret fields are hidden until you reveal them. Copying a password or a one-time code goes through the secure clipboard, which clears it after 45 seconds.
Add items
Section titled “Add items”- New item creates an item of any kind from an empty template.
- From this device copies something you already use into the vault: a server, a key from the key library, a dashboard metric or a snippet. The original stays where it is.
If an item changes on another device while you are editing it, the editor warns you before your save overwrites that change.
Servers and other app data
Section titled “Servers and other app data”A vault also lists the servers, SSH keys, snippets, dashboards and workspaces that belong to it. Anything you create in the app belongs to your personal vault until you export it. A workspace row shows its server and root folder.
Tap any row for its actions:
| Action | Shown for | What it does |
|---|---|---|
| Item details | Every row | Opens the item, or the app’s own screen for a server, key, snippet, dashboard or workspace |
| Export to a team vault… | Rows in your personal vault | Copies it into a team vault. Your copy stays. |
| Import to your personal vault | Rows in a team vault | Copies it into your personal vault. The shared copy stays. |
| Delete from team vault | App data in a team vault | Removes it for every member |
Exporting a server, or a workspace together with its server, asks two more questions:
- Share connection credentials. Off by default: members get the connection and sign in with their own password or key.
- Also export key (when the server uses a key from your library). Copies the key into the team vault and links the shared server to it, so members can see and reuse it. A key with the same key material that is already in that vault is reused instead of copied again. Without this option, a shared key still travels inside the server’s credentials, but members cannot see or reuse it.
Importing a server works the same way in reverse: Also import key copies its key into your personal vault and links the server to it.
Find and organize
Section titled “Find and organize”The search field searches every vault and every item kind at once. Filter chips narrow the list by kind.
Vaults can be grouped into folders on the vaults page. Folders exist only on the device where you create them: they don’t sync and have no effect on access or encryption. Deleting a folder keeps the vaults that were in it.
Team vaults
Section titled “Team vaults”A team vault shares items with members of a team on a paired server. Create one with New team vault…. The creator holds Can manage.
| Level | Allows |
|---|---|
| Can view | Reading items. Items other members add appear automatically. |
| Can edit | Adding, changing and deleting items and copying items into the vault |
| Can manage | Everything above, plus granting and revoking access |
When your level doesn’t allow an action, the app says which permission the action needs instead of failing silently.
To copy a shared item into your own vault, use Import to your personal vault. The shared copy stays in the team vault. Moving an item to another vault re-encrypts it for the new vault’s members, and members of the old vault lose access to it.
Accept a shared vault
Section titled “Accept a shared vault”When a teammate grants you access, the vault key arrives on each of your devices. A device that has already verified the teammate’s device takes the vault on directly. Otherwise the vaults page shows Vault shared with you with Review:
- Tap Review. Accept shared vault shows the fingerprint of the device that shared the vault.
- Ask the teammate to read their device’s fingerprint from Settings › Security on that device, and compare the two.
- Confirm that the fingerprints match and tap Accept vault.
Decline discards the share; it comes back for review if the teammate shares the vault again. A share that doesn’t verify against the confirmed device, or that comes from a revoked device, is discarded.
Grant access
Section titled “Grant access”- Select the vault, tap the members icon in the top bar, then tap Grant access.
- Pick the member and the permission.
- The vault key is sent to each of the member’s devices. Ask the member to read each device’s fingerprint from Settings › Security on that device and compare it with the fingerprint shown in the dialog.
- Confirm The fingerprints match and tap Grant access.
The member needs at least one device that already holds a vault key. The fingerprint check is the defense against a server that substitutes its own key for the member’s.
Revoke access
Section titled “Revoke access”Revoke & rotate cuts the member’s access immediately and rotates the vault key: every item is re-encrypted under a new key and uploaded again, and the remaining members receive the new key automatically. Progress is shown in four stages: fetching current members, syncing vault records, rotating the vault key and re-encrypting items.
A vault that is locked on the current device cannot be rotated from it. Unlock it first, or rotate from another device that holds the key. Removing a member from the team rotates their team vaults the same way; see Teams.
Encryption
Section titled “Encryption”Each vault has its own AES-256-GCM key. That key is wrapped separately for each device that may read the vault, and a team vault’s key goes only to the active devices of its current members. On your own devices, unwrapping also needs your app password. The server stores the wrapped keys and the encrypted items and cannot decrypt either.
The Argon2id parameters, the hardware-backed device keys and the device approval flow are described in App Password & Vault Security.