Connection vaults

A vault is an encrypted container for everything you need to reach your servers: hosts, identities, groups, port forwards, access profiles and known host keys. You can keep several, for example one for work and one for personal servers, each with its own password.

Create a vault

On Home, click New vault.
Enter a Name, a Password and Confirm password, then click Create vault.
Copy the recovery key and store it somewhere safe, such as a password manager. It's shown only once. Tick the box to confirm you saved it, then click Done.

The password encrypts the vault. It never leaves this device, and nobody, including Kubexer, can reset it. Without the password or the recovery key, the vault can't be opened.

Open, lock and unlock

Open a vault from its card on Home. A locked vault asks for its password first. If you've lost the password, choose Use recovery key instead.
Lock clears the decrypted contents from memory. Use Lock vault on the card's menu, or Vault settings → Lock.
An open vault gets its own tab in the top bar. Closing the tab ends its terminals, and the app asks first.

Some things stay available while a vault is locked: Snippets and Shell History are global, not part of any vault.

Vault settings

Open a vault, then Vault settings in its sidebar:

Name — rename it. This only changes the label, not the contents or password.
Lock vault.
Cloud sync — sync this vault across your devices. See Vault sync.
Change password — re-encrypt the vault with a new password.
Delete vault — permanently removes the vault and everything in it, here, in the cloud and from your other devices.

Rename and Delete vault are also on the vault card's menu on Home, so you can still clean up a vault whose password is lost.

Security model

Contents are encrypted on this device before they're stored or synced. The server only ever stores ciphertext.
AI agents and other tools can only reach vaults you've unlocked, and never see passwords or keys.

Lost everything?

If both the password and the recovery key are lost, the data can't be decrypted. Settings → Account → Reset all vaults deletes every vault, on this device and in the cloud, so you can start over. This can't be undone.

Hosts & groups · Identities & SSH keys · Your first connection