Android KeystoreFingerprint or screen lockLocked
Keys sealed by hardware
Your vault keys are locked by a key in the Android Keystore. They open with your fingerprint, face or screen lock.
Locked before it leaves
your phone
Plain answers about how your vault is protected, including why even we cannot open it.
Gmail password
On your phone
••••••••••••
Locked here firstBefore it leavesSent
Vault key
Kept in
Phone's secure hardware
Your fingerprintNeeded to open the vaultUnlock
9:41
SettingsSecurity
- Auto-lock1 minute
- Hide Vaukt from screenshots
- Check for known leaks
- Your devices2
Activity
Signed inThis phone · today
HomeVaultCodesSettings
Our servers
Stored copy
a9F3k…x2Lq7
Locked copy onlyLocked on your phone firstStored
Recovery requested
Waiting period
23 h 59 m left
Not you?Cancel on a trusted phoneCancel
How it worksYour vault travels locked,
Your vault travels locked,
and opens only for you.
1 · On your phone
Locked
Items are encrypted before they leave.
Gmail password
On your phone
••••••••••••
Locked here firstBefore it leavesSent
2 · On our servers
Locked
Only the locked copy is stored, so we cannot read it.
Our servers
Stored copy
a9F3k…x2Lq7
Locked copy onlyLocked on your phone firstStored
3 · Getting back in
Your code
Opened only with your recovery code, kept in your Google account or on your USB drive.
New phone
Google account
you@gmail.com
Recovery code foundOpens with your fingerprintOpen
On your phoneEvery layer,
Every layer,
switched on.
Your phone
Hardware keys
Your vault key lives in your phone's secure hardware and needs your fingerprint or screen lock to use.
Vault key
Kept in
Phone's secure hardware
Your fingerprintNeeded to open the vaultUnlock
Auto-lock
You choose
Right away, or after 30 seconds, 1 minute, 5 minutes, 15 minutes, 1 hour. Or never.
Vaukt is locked
Lock after
30 seconds
UnlockUse your fingerprintUnlock
Clipboard
Clears itself
Wiped after 15 seconds to 2 minutes (30 by default), or never.
Sign in to Gmail
Password
••••••••••••
CopiedClears after your delayPaste
Breach check
Off by default
Turn it on to check passwords against Have I Been Pwned. Only the first 5 characters of a one-way hash are sent.
Breach check
Sent to Have I Been Pwned
5BAA6…
Off until you turn it onFirst 5 hash characters onlyCheck
Built in
And under the hood
Request signedThis phone · just nowSent
Every request signed
Each request carries a signature from your device. Replays are rejected.
Hide from screenshotsRecent apps blurredOn
Hardened app
HTTPS only, user-installed CAs ignored, our server pinned, cloud backups off, and an optional screenshot block.
Backup fileHas its own passwordExport
Encrypted backup file
Locked with its own password of 12+ characters. Includes passkeys. Anyone with both can open it.
New device addedWork tablet · todayView
Activity
See sign-ins, new devices and changes to your vault.
Google Drive login28 days leftRestore30-day trash
Restore anything deleted by mistake.
Getting back inLost your phone?
Lost your phone?
Your key is yours.
- 1Sign in with GoogleOn the new phone, sign in with the same Google account you used before.
- 2Your key is foundYour recovery code is saved with that account, encrypted by Google with your screen lock. Vaukt never sees it.
- 3Open with a fingerprintOne fingerprint and your vault opens. A USB copy of the code works too, if you saved one.
Recovery requested
Waiting period
23 h 59 m left
Not you?Cancel on a trusted phoneCancel
By default Vaukt keeps no copy of your key, so we cannot open your vault, not even to help you. Keep your recovery code safe (it is saved with your Google account, and you can add a USB copy). If you would like a safety net, you can optionally turn on Support recovery in the app: we then hold a locked spare that our admin can open only after you ask, we check it is you and approve, and a 24-hour wait passes in which you can cancel.
