Vault

The Vault stores passwords, notes, cards, API keys, SSH keys and identities with zero-knowledge encryption. You keep your own items in a personal vault and share team passwords through space vaults. The Crewhall browser extension fills and saves sign-ins in Chrome and Edge.

What zero knowledge means for you​

Everything in the vault is encrypted and decrypted on your device. The vault opens with a vault password that is separate from your account password and never leaves your device. The server stores only encrypted items and wrapped keys.

• Nobody at your organization can read your vault, not even admins. Admins cannot open your personal vault.
• The vault health report, search and version history are computed on your device.
• Signing in to Crewhall does not unlock the vault. Locking the vault does not sign you out.

Guest accounts have no vault.

Set up your vault​

The first time you open Vault, setup has three steps: Vault password, Recovery key and Ready.

1. Enter a vault password and repeat it. It must be at least 12 characters, must not contain your email or name, and must not be in leaked password lists (checked on the device). A passphrase of four random words works well. Do not reuse your account password.
2. Save the recovery key. It is shown only once. Use Download or Print, then tick I saved my recovery key somewhere safe.
3. Select Open the vault.

Unlock and lock​

When the vault is locked, enter your vault password and select Unlock. You can also use Unlock with passkey (Touch ID, Windows Hello or a security key) after you add a passkey under Vault › Settings. In the desktop app you can open the vault with Windows Hello or Touch ID; your vault password is still asked every few days.

Select Lock in the sidebar, or press Ctrl L, to lock it at once.

Auto-lock rules​

Open Settings in the vault sidebar to change these. They belong to your account and follow you to other devices.

The vault also locks when the computer locks.

Recovery​

If you forget your vault password, select Forgot your vault password? and then Open with the recovery key. Type the key (spaces and dashes do not matter), select Check the key, then set a new vault password.

Under Settings › Recovery and encryption you can Create a new one recovery key. The old key stops working at once. You can also Change vault password there.

Personal and space vaults​

• Personal is your own vault. Only you can open it.
• A space vault holds a team's passwords. To create one, select + next to Vaults in the sidebar, choose a space and name the vault. The vault key is made on your device and wrapped for you only. You then grant access person by person.

Use Search all vaults in the sidebar to search every vault you can open. To move items, use Move to another vault. The items are re-encrypted with the target vault's key on your device.

Items and categories​

Select New item and pick a type:

The categories in the sidebar are All, Favorites, Logins, Notes, Cards, API keys, SSH keys, Identities and Trash. You can also filter by Tags.

Each item can have tags, an Environment tag (Test or Prod), several websites, custom fields (Text, Hidden, Checkbox, Date) and encrypted attachments up to 100 MB. For TOTP, paste an otpauth:// link or the secret key; the item then shows the current code. Items with an expiry date warn you before they expire.

• Version history keeps the last 10 versions of an item. Restoring one saves it as a new version.
• Move to trash keeps an item in Trash for 30 days. Use Restore or Delete forever.

Password generator​

While editing an item, select Generate password next to the password field. Choose Password (length, uppercase, lowercase, digits, symbols, Avoid look-alike characters) or Passphrase (number of words, language, separator, Capitalize, Add a digit). The strength and estimated time to crack are shown. Select Use to put the value in the field.

Share access​

Open a space vault and select Access, then Grant access. Pick a person and a permission:

The person must have set up their own vault. The vault key is wrapped on your device with their public key. To be sure, compare the fingerprint shown with the one on their Vault › Settings screen. If the person is not a member of the space, granting access also adds them as Viewer.

Remove access rotates the vault key: items are re-encrypted on your device with a new key for the remaining members. The removed person cannot open new items. Consider changing the passwords they may have seen.

One-time links​

To send one item to someone outside your organization, open it and select Share with a link. Set Valid for and Number of opens, and choose whether to include notes or the TOTP key. The key is only in the part of the link after # and never reaches the server. You see the link once. Revoke it under Open links.

Vault health​

Vault health in the sidebar scans the items you can access for expired or expiring items, reused, weak and old passwords (older than 1 year), and passwords seen in breaches. Use Renew or Generate password to fix them. The report is computed on your device, so there is no organization-wide report.

Access log​

People with Manage see Log on a space vault. The Access log lists unlocks, views, copies, edits and access changes with time, person, device and IP. Filter it and Download CSV. Entries cannot be deleted and are kept for 1 year.

Import and export​

Select New item, then Import from Bitwarden. Supported files are Bitwarden JSON, password-protected JSON, Bitwarden CSV and a Chrome password export (CSV). The file is read in your browser and never sent to the server. The steps are File, Vault mapping and Result: choose which folder goes to which vault, optionally add folder names as tags, and skip duplicates. Delete the export file when you are done.

Settings › Export writes the items you can access to a password-protected, Bitwarden-compatible JSON file.

Organization policy​

Admins see Organization policy under vault settings. It turns the Leaked password check on or off and sets limits for One-time share links. The leak check sends only the first 5 characters of a password's SHA-1 hash. See Administration.

Browser extension​

The Crewhall extension works in Chrome and Edge.

1. Open the extension's settings, enter your Crewhall address and select Connect. You sign in on Crewhall's own page.
2. Turn on Turn on the vault feature. The browser asks for access to all sites; the extension reads pages only to fill and to offer saving.
3. Open the extension (Ctrl Shift L) and unlock with your vault password.

The popup shows items for the current site. Select Fill, or copy the username, password or verification code. Generate a password writes a new password into the page's password fields. After you sign in on a site, the extension asks whether to save or update the sign-in; choose Save, Not now or Never on this site.

For your safety, filling happens only when you click, only on a site whose address matches the item exactly, and never on pages without an encrypted connection.