Vault Encrypted at rest

About Vault

How your data is handled

What Vault stores, how it is protected and when it is deleted. No marketing, just how the code works.

Encryption

Every secret is encrypted on the server with AES-256 before it is written to the database. The key lives in the application configuration, not in the database.

This is server-side encryption, not end-to-end. Whoever controls both the database and the application key, which means the operator, could technically decrypt a secret without a password.

Secrets with a password

A password-protected secret is sealed a second time with a key derived from its password (HKDF-SHA256, AES-256-GCM). The password itself is never stored, so the database and the application key together are not enough to read it.

The password is generated by the server and passes through it again when the secret is opened. It is not kept, but you are still trusting the server at those two moments.

When secrets are deleted

  • A one-time secret is deleted the moment it is revealed.
  • Any secret is deleted when it expires, after 1 hour, 24 hours or 7 days. Expired secrets are removed every minute.
  • A one-time secret nobody opens stays in the database until it expires.
  • The database is backed up daily. An encrypted copy of a deleted secret can remain in a backup until that backup is rotated out.

What else is recorded

  • A session with your IP address and browser user agent, kept for two hours. It protects the forms against forged requests.
  • Your IP address in a rate limiter that blocks password guessing, kept for one minute.
  • Server and proxy logs, which can contain your IP address and the requested URL.
  • Application error logs, used to investigate failures.

Visits to the home page and this page are counted by a self-hosted Umami instance. It sets no cookies, does not store your IP address and respects Do Not Track. Pages that show or create a secret never load it, so neither the script nor the analytics ever see a secret or its link.

There are no accounts, advertising or third-party scripts. Pages are sent with Cache-Control: no-store and Referrer-Policy: no-referrer, so the browser does not cache a secret or leak its link to other sites.

Hosting and contact

Vault runs on a Hetzner server in Germany, inside the EU. It is operated by Vladislav Rajtmajer. Questions or data requests go through .

Create a secret →