Five minutes. No jargon. Everything you need to keep your passwords safe.
Think of the vault as a steel box. Your account keeps a scrambled copy online; this browser keeps a spare copy for offline use. Only your master passphrase or recovery key opens it.
Create an account with your email and an account password, confirm your email, then sign in. This password gets you to the box — it does not open it. If this browser has an old vault, choose Migrate existing vault to preserve it.
This is the one key you memorize. Make it long — a short sentence works great. It never leaves your device.
When you create the vault you get a spare key. Print it or write it down and put it somewhere safe. If you forget your passphrase, this is the only way back in.
Press Add, fill in the service, username and password (or hit Generate). Click the copy icon to copy — your clipboard wipes itself after 30 seconds.
Edits sync automatically while connected. If sync is pending, keep this browser’s site data until it finishes. Save a Faraday Cube (.cube.json) from Settings or Backup too. Sign in before restoring it; restore replaces your account vault. View and auto-lock settings follow your account.
Press the padlock to lock, or let the auto-lock timer do it when you walk away.
How it works: make a spreadsheet with one password per row and a header row on top. Save it as .csv, .xls or .xlsx, then drop it in. You'll see a preview before anything is saved.
| Field | Header names that work | Rule |
|---|---|---|
| Service | service, title, name, system, app | Required — rows without it are skipped |
| Username / Email | username, email, user, login, account | Optional — can be empty |
| Password | password, pass, secret, key | Optional — can be empty |
| URL | url, website, link, target, domain | Optional — "github.com" becomes https://github.com |
| Category | category, type, group | Optional — guessed if empty |
| Notes | notes, note, comments, memo, details | Optional — can be empty |
Big vaults are big targets. Centralized password services have been breached repeatedly; when the provider holds the keys, a single break-in exposes millions of people.
Reuse is the #1 risk. Attackers take leaked passwords from one site and try them everywhere ("credential stuffing"). One reused password can unlock your whole life.
Encrypt before it leaves. This vault scrambles everything in your browser with AES-256-GCM and PBKDF2 before it's stored, so a stolen copy is just static.
You hold the math. You hold the keys.