Frequently asked questions
Tap a question to expand it.
Does anything run in the cloud?
No. Your credentials live on theVault and nowhere else. There is no user account, no synchronisation through a server and no component running on the internet. The backup, too, is an ordinary file that stays wherever you put it.
That was the very reason paXCry exists: a password manager that works without anyone else's servers.
What happens if I lose theVault?
Without the PIN, nobody can reach the stored data. The PIN is checked by the security chip, and after ten failed attempts at most theVault wipes itself completely – even if power is removed in between.
That is why an up-to-date backup matters: it lets you restore your credentials onto a new device.
What if I forget the PIN?
Then you cannot reach the stored data any more. There is no back door and no code that bypasses the PIN – that would be exactly the gap an attacker would look for. This is what the backup is for.
Why can passkeys not be backed up?
A passkey is bound to the security chip of this very device and never leaves it – which is also why it cannot be read out or copied. The backup contains your passwords and one-time codes, but no passkeys.
If you keep a second device as a spare, register it with each service as well – just as with any other security key.
Do I need an app on the target device?
No. theVault registers as a USB keyboard and types the username and password into whatever window is active. That works on any device with a USB port, including one that is not yours. Passkeys work straight from the browser.
What is the PC app for, then?
For managing things: adding, editing and deleting credentials and one-time codes, generating passwords, creating and restoring backups, updating the firmware. You do not need it for everyday use.
How many credentials fit on theVault?
More than 250 entries. The name may be 31 characters long, the username and password 63 each.
Why can a password not contain a semicolon?
The semicolon separates the individual fields in the connection between the PC app and the stick. In the middle of a password it would make the stick start a new field there and discard the rest.
Every other special character is allowed, and the password generator uses them.
How secure is the backup?
The backup file is encrypted with AES-256-GCM; the key is derived from a password of your choosing using Argon2id. Any tampering with the file is detected when restoring.
That password cannot be recovered. Without it the file is worthless – to you as well.
Which operating systems are supported?
The PC app is available for Windows, macOS and Linux. Signing in to your PC is currently available for Linux only. Passwords and passkeys work regardless of that on any device with a USB port.
Why a separate device instead of just a program?
A password manager on your PC is only ever as secure as that PC. theVault keeps the credentials on a separate device with a security chip that does this one job and can be unplugged.
That does not remove the risk entirely: if the computer you plug the stick into is already infected, malware there can read what is typed. That is true of any keyboard.
Can I buy theVault yet?
Not yet. theVault is currently being trialled as a pre-series. As soon as that changes, it will be announced on this page.