Using GrailVault
Copy, reveal and locking
How GrailVault limits how long your secrets are visible, copied or unlocked.
GrailVault tries to keep your secrets on screen, on your clipboard and in memory for as short a time as is practical.
#Hidden by default
Secret fields show as dots. Choose Reveal to display one. A revealed secret hides itself again after 15 seconds. Choose Hide to hide it sooner.
#Copy
Choose Copy next to a field to put its value on your clipboard.
- For secret fields, GrailVault clears the clipboard again after 30 seconds, if it still contains what you copied.
- For ordinary fields such as a username, nothing is cleared.
- Your recovery key is cleared after 60 seconds when you copy it.
Note
Clearing the clipboard is best effort. A browser only allows it while the page is open and allowed to access the clipboard, and some systems keep a clipboard history that GrailVault cannot erase. For very sensitive items, prefer typing or revealing over copying.
#Locking
GrailVault does not lock on a timer: once you sign in, the vault stays open while the tab is open, so you are never interrupted. It locks when:
- you choose the Lock button in the top bar,
- you sign out, reload the page or close the tab, or
- the session is ended from another device or expires.
Locking wipes your keys and the decrypted items from the browser's memory, ends the session on the server and returns you to the sign-in page. Your keys are kept only in memory and never written to disk or browser storage. After a lock you sign in again with your master password, device unlock or two-factor code.
Lock the vault, or close the tab, when you leave a shared or public computer.
#Sessions last at most 12 hours
Even if you stay active, a sign-in expires after 12 hours. You can see and end your sessions under Active sessions.