Auto-Lock

Your vault automatically locks after 15 minutes of inactivity. Decryption keys are purged from memory — no traces left behind.

15-Minute Timeout

After 15 minutes without interaction, the vault locks automatically. The unlock timestamp is refreshed on every request, so active use keeps it open.

Keys Cleared from Memory

When the vault locks, session data is destroyed. The encryption key in sessionStorage is removed. Re-entering the master password is required to re-derive keys.

Manual Lock

Don't want to wait? Click "Lock Vault" in the sidebar anytime to instantly lock your vault. Useful when stepping away from your desk, even briefly.

Defense in Depth

Auto-lock protects against session hijacking, shared computers, and the "walked away from my laptop" scenario. Even if someone has your browser, they need your master password.

What happens when the vault locks

Server session marked as locked
Encryption key cleared from browser sessionStorage
All vault routes redirect to the unlock screen
User must re-enter master password to continue
No cached plaintext data remains accessible

Auto-Lock

15-Minute Timeout

Keys Cleared from Memory

Manual Lock

Defense in Depth

What happens when the vault locks

Security that works while you don't