# Managing entries in the credentials vault

{/* AUTO-SYNCED SOURCE: this page lives in apps/app/src/modules/credentials/docs/ and is mirrored into the docs app by `bun sync:module-docs`. Edit it in the module, not in apps/docs. */}
<Lead>
Every login is an **entry** in the vault: a title, an encrypted secret and the metadata around it. This page walks you through the list, every field in the entry form, secure revealing and the CSV import.
</Lead>

## The list

The credentials vault (Zugangsdaten-Tresor) shows every entry you are allowed to see in one flat list. Each row contains:

- the **title** and a badge for the **type** (password, API key, PIN code, secure note)
- the badge **Sensibel** (sensitive) for elevated confidentiality and the badge **Persönlich** (personal) for private entries
- a second line with email, username or login URL, while the secret stays masked as "••••••"

Hovering over a row reveals the actions **Zum Login öffnen** (open login page), **Anzeigen** (reveal), **Teilen** (share), **Bearbeiten** (edit) and **Löschen** (delete). The header offers the buttons **Mitarbeiter-Zugänge** (staff logins), **Tresor-2FA** (vault 2FA), **Gruppen** (groups, only with the matching permission), **Import** and **Neuer Eintrag** (new entry).

### Search

The search field **Suchen (Titel, URL, Username, Tags)** filters the list as you type. Important: search **never looks inside the secret itself**, only in the metadata. If nothing matches you will see **Keine Treffer für deine Suche.** (no results). While the vault is still empty, the list shows **Noch keine Einträge. Lege deinen ersten Zugang an.** (no entries yet, create your first login).

## Creating and editing entries

**Neuer Eintrag** (new entry) walks you to a finished entry in two steps. Everything beyond that is optional.

<Steps>
  <Step title="What is it?">
    At the top there is a search box, **Bekannter Dienst** (known service). Type "immo", "datev" or "sparkasse" and the vault suggests the matching service; picking it fills in the name, the login address, the type and the suggested confidentiality level. If your service is not in the catalogue, pick the **type** as a card instead: password, key safe, WiFi, alarm, PIN, API key, bank login, secure note or certificate. Next to it you set the visibility (shared or personal).
  </Step>
  <Step title="The credentials themselves">
    Now the vault only asks for what this type actually has. A password needs a login address, an email or username, and the password. A key safe needs the code and the property, nothing else. For passwords, **Erzeugen** (generate) creates a strong password that is still safe to read out loud, and the rating below tells you in one sentence what is wrong with a weak one.
  </Step>
  <Step title="Save, or add more">
    From here you can hit **Anlegen** (create). **Mehr Angaben** (more details) takes you to folder, expiry date, property, customer number, second factor, note, tags, attachments and the confidentiality level.
  </Step>
</Steps>

If something required is still missing, it is spelled out next to the buttons ("Es fehlt noch: Passwort"). A greyed-out button without a reason would be a dead end.

<Warning title="For passwords: email or username is mandatory">
For the password type you need at least one of the two. A password without an account attached cannot be matched to anything later.
</Warning>

**Editing has no steps**: everything sits on one surface, because you usually came for one particular field. The secret field then reads **(leer lassen = unverändert)** (leave empty = unchanged); leaving it empty keeps the stored secret untouched.

### Attachments

Under **Mehr Angaben**, **Aus dem Dateispeicher wählen** (pick from the file store) attaches one or more files: the certificate for a passphrase, a licence file, a photo of the key box. The file stays in the file store; the entry only holds a reference to it. That also means anyone who may see the entry sees the file name.

### Expiry date and reminder

Give a **shared** entry an expiry date and the vault creates a task for your office two weeks ahead, linked to the entry. The reminder then sits where your team looks anyway.

<Callout tone="note">
Personal entries get no task. Their name would end up in a list the whole office can see, which is exactly what a personal entry is not for. They still appear in the vault check, and there only the owner sees them.
</Callout>

## Revealing a secret safely

The **Anzeigen** action opens the **Zugangsdaten anzeigen** (show credentials) dialog. It immediately shows email, username and the login link, each with a **Kopieren** (copy) button. The secret itself is fetched with **Geheimnis anzeigen** (reveal secret); the dialog points out: **Jeder Zugriff wird protokolliert (Wer, Wann, Warum).** (every access is logged: who, when, why).

- For entries on the **sensitive** level you must first fill in **Grund für den Zugriff (Pflicht)** (reason for access, required), for example "login for property handover". The reason goes into the audit log.
- For **hyper-sensitive** entries you first unlock with your master password (plus a 2FA code if set up). Details: [Security](/tools/zugangsdaten-tresor/sicherheit#the-master-password-hyper-sensitive-only).
- After revealing, the secret and the notes are shown with copy buttons.

<Tip title="The clipboard cleans up after itself">
When you copy a secret, the vault automatically clears your clipboard 30 seconds later, as long as you have not copied anything else in the meantime. No password lingers in the clipboard by accident.
</Tip>

<Info title="Customer number">
You maintain an entry's customer number in the edit dialog. It is currently not shown in the reveal dialog.
</Info>

## Deleting and the trash

The **Löschen** action asks for confirmation: **"{title}" wandert in den Papierkorb und ist wiederherstellbar, bis die Aufbewahrungsfrist abläuft.** (the entry moves to the trash and stays restorable until the retention period ends). Deleted entries are not gone immediately. How long they remain restorable is set by your admin in the tool settings under **Papierkorb-Aufbewahrung** (trash retention, 30 to 365 days). After that they are removed for good.

## Import from CSV

The **Import** button opens the **Einträge importieren** (import entries) dialog for **CSV from browsers, 1Password, Bitwarden or Excel**. The import runs in three steps:

<Steps>
  <Step title="Choose a file">
    Pick your CSV export file. The dialog makes it clear: the file is only read inside your browser, nothing is uploaded without your action. Entries are only created once you complete the import.
  </Step>
  <Step title="Map the columns">
    The vault auto-detects common columns and maps them to the fields title, login URL, email, username, password and notes. You can adjust the mapping and additionally set visibility, confidentiality and **In Gruppe** (into a group) for all imported entries.
  </Step>
  <Step title="Import and check the result">
    After the import the dialog reports: **{n} Einträge importiert, {m} Duplikate übersprungen.** (entries imported, duplicates skipped).
  </Step>
</Steps>

Good to know:

- **Duplicate rule:** an entry counts as a duplicate when the combination of title, URL, email and username already exists in the vault. Duplicates are skipped, nothing gets overwritten.
- Imported entries are created with the type **Passwort** (password).

## Further reading

How to grant entries to colleagues or external partners is covered in [Sharing](/tools/zugangsdaten-tresor/teilen). What is behind the confidentiality levels and the master password is explained in [Security](/tools/zugangsdaten-tresor/sicherheit). Back to the overview: [Credentials vault](/tools/zugangsdaten-tresor).