The web app

The web app is where you create your account and manage entries directly. It's a single-page app that talks to your backend and does all encryption in the browser.

Create an account

Open the web app

Navigate to your deployment's URL (whatever you configured as the server URL when running the server).

Provide an email, a display name, and choose an unlock password. The app generates your device's keypairs in the browser, wraps the private keys under your unlock password, and registers the public keys with the server. The first account on a fresh instance becomes the admin.

Download your backup

Right after signup the app takes you to the backup step: pick a backup passphrase (12+ characters) and download the encrypted key file. This is your recovery path if you lose the device, store the file and passphrase separately. See Backing up & recovering.

You're in

You land in an unlocked vault. Add your first entry. For extra safety, also pair a second device, any one recovery factor (a spare device, your backup file, or operator backup) is enough to get back in.

Your unlock password is unrecoverable

The unlock password never reaches the server, so no one can reset it. If you forget it on a device, that device's stored keys are unusable, you recover by unlocking on another paired device (or via operator backup). Choose something you'll remember; the minimum length is 8 characters.

Unlock

When you return to a locked app, enter your unlock password. This decrypts the keys already stored locally, it's not a network login, and it works even if the server is down. An incorrect password simply fails to decrypt; there's no lockout counter on the server because the server isn't involved.

A new browser is a new device, so you get in one of two ways:

Pair from an existing device: the new browser generates its own keys and a device you already have authorizes it. See Devices & sharing.
Restore from your backup file: on the Recover page, upload the backup JSON and its passphrase. This works even if you have no other device. See Backing up & recovering.

Manage entries

Vault list: every entry you can read (entries you own and entries shared with you). Search filters as you type.
Create / edit: adding or editing an entry publishes a new signed version, encrypted separately for each recipient device. Edits use optimistic concurrency, so a stale tab can't overwrite a newer change.
Detail view: opening an entry fetches and decrypts its current version locally, then reveals fields on demand.

See Entry types for what each kind stores.

Settings

Backup opt-in: if the operator has configured a backup key, you can opt your entries in so they're recoverable from the operator's offline key. Off by default.
Devices: review, rename, and revoke your paired devices.
Sync interval: how often the app pulls vault changes in the background (the online indicator reflects reachability between syncs).

The web app vs. the extension