The credentials vault (Zugangsdaten-Tresor) encrypts every secret, but not every secret equally strictly. This page explains what the three confidentiality levels mean technically, when you need a master password, how vault 2FA works and which policies your team can define.
The three confidentiality levels in detail
Two special rules apply to hyper-sensitive entries:
- They can not be shared externally via link.
- If you change an entry's confidentiality level, you must re-enter the secret and the notes. That is not a bug: the data has to be re-encrypted for the new level.
The master password (hyper-sensitive only)
The master password applies exclusively to entries on the hyper-sensitive level. Standard and sensitive entries do not need one, and it does not lock the vault as a whole.
When you set it up, the dialog warns you in no uncertain terms: this password is NOT your login. Without it, nobody, not even us, can decrypt your hyper-sensitive entries. There is no recovery. Your team's policy defines how long and how strong the master password has to be (default: 12 characters, medium strength); the dialog tells you during setup if it falls short.
From then on:
- To reveal a hyper-sensitive entry you unlock with Gib dein Master-Passwort ein (enter your master password). A wrong entry shows Falsches Master-Passwort. (wrong master password).
- If vault 2FA is set up, the extra step Zweiter Faktor (second factor) follows, asking for the code from your authenticator app.
- The decrypted key stays only in the current browser tab. Reloading the page or closing the tab means unlocking again.
Unlocking with your fingerprint instead of the password
Nobody types a long master password on a phone several times a day. Anyone who tries picks a short one, and then the strongest level is the weakest. So you can enrol each device once and unlock with fingerprint, face recognition or the device PIN afterwards.
Unlock once with the master password
Right after that the vault asks: Auf diesem Gerät merken? (remember on this device).
Confirm
Your device asks for your fingerprint or face. Done.
From now on
The unlock dialog shows Mit diesem Gerät entsperren (unlock with this device) at the top. The master password stays below it and keeps working.
Your master password is not stored. The key is wrapped in a value that only this device hands out, and only after it has verified you. Our servers hold nothing but the wrapped package. Without the device it is worthless, to us as well. The promise of the highest level does not change.
You can enrol several devices (phone and computer) and remove individual ones. The list sits in the unlock dialog, which is exactly where you look for it when a device has gone missing.
Vault 2FA
Tresor-2FA (vault 2FA) is a second factor specifically for the vault, using TOTP codes from an authenticator app: when unlocking hyper-sensitive entries, and, if your team requires 2FA, additionally as a confirmation for sensitive entries, external links and imports (see below). It is separate from the two-factor login of your platform account: you set it up yourself inside the vault via the header button Tresor-2FA.
Connect your app
The dialog shows a setup key (Base32) and an otpauth link for common apps such as Google Authenticator, 1Password or Aegis. Use Schlüssel kopieren (copy key) to transfer the key into your app.
Confirm with a code
Enter the current 6-digit code under Code aus der App zur Bestätigung (code from the app to confirm). Vault 2FA only becomes active with a valid code.
Done
From now on, unlocking requires a code from your authenticator app in addition to the master password.
To deactivate, open the same dialog and enter a valid code under Zum Deaktivieren aktuellen Code eingeben (enter current code to deactivate). If a code is rejected, the message reads: Der Code stimmt nicht. Prüfe die Uhrzeit deiner Authenticator-App. (the code does not match, check your authenticator app's clock). TOTP codes depend on the time; a drifting device clock is the most common cause.
Confirmation when 2FA is required
If your admin has switched on the 2FA requirement, the vault checks the second factor not only in the browser but on the server. Specifically:
- When opening a sensitive or hyper-sensitive entry, when fetching a one-time code for it, when creating an external link and when importing, the vault asks once for the code from your authenticator app. The confirmation then lasts as long as a vault session according to the policy (at most twelve hours with Bis Browser schließt), not again for every entry.
- Standard entries still open without a code.
- If you have not set up vault 2FA yet, exactly these steps are blocked until you do. The dialog takes you straight there.
- The fingerprint route for unlocking stays without an additional code, as described above. The server still asks for the confirmation for sensitive entries once per session, because only the code from the app is verifiable for it.
Team policies
At /settings/tools/credentials (section Sicherheit & Standardwerte, security and defaults) your admin defines the vault policies for the whole workspace. Note: Nur Admins dürfen speichern. (only admins may save).
Tab Sicherheit (security):
The former setting Export nur mit Grund (export requires a reason) has left the panel: the vault has no export it could govern. It returns once there is one.
Tab Allgemein (general):
Further reading
How revealing with a mandatory reason works in practice is shown in Managing entries. Who may do what in the vault is covered in Audit and permissions. Back to the overview: Credentials vault.