# Troubleshooting the credentials vault

{/* AUTO-SYNCED SOURCE: this page lives in apps/app/src/modules/credentials/docs/ and is mirrored into the docs app by `bun sync:module-docs`. Edit it in the module, not in apps/docs. */}
<Lead>
Something stuck in the vault? Here are the most common questions from daily use, with honest answers: some things are quick to fix, and with zero-knowledge there is deliberately no safety net.
</Lead>

## Frequently asked questions

<Faq>
  <FaqItem q="I forgot my master password. What now?">
    The honest answer: your **hyper-sensitive** entries are irretrievably lost without the master password. There is no recovery, no admin reset and no operator backdoor; that is the core of the zero-knowledge promise in the credentials vault (Zugangsdaten-Tresor). All entries on the **standard** and **sensitive** levels are unaffected and keep working normally. Re-create the affected logins, ideally after rotating the password at the service in question.
  </FaqItem>
  <FaqItem q="My 2FA code is rejected.">
    The message reads: **Der Code stimmt nicht. Prüfe die Uhrzeit deiner Authenticator-App.** (the code does not match, check your authenticator app's clock). TOTP codes are time-based: if your device's clock is off by even a minute, the codes no longer match. Set the device time to "automatic" and try again with the next fresh code.
  </FaqItem>
  <FaqItem q="An entry has disappeared, or I cannot see it.">
    Three candidates, checked in this order: (1) the entry is **personal** and belongs to someone else, then it is invisible to you, admins included. (2) The entry is shared but **not shared with you**: as a member you only see your own entries plus what was granted to you; ask the creator for a share. (3) Your **role** may not open the vault; viewers have no access by default. Details: [Audit and permissions](/tools/zugangsdaten-tresor/audit-und-berechtigungen#roles-and-permissions).
  </FaqItem>
  <FaqItem q="An external link no longer works.">
    External links expire after the chosen lifetime (7 days at most) or were revoked. An expired or revoked link cannot be reactivated: simply create a new link and send it again. How-to: [Sharing](/tools/zugangsdaten-tresor/teilen#external-sharing-via-link).
  </FaqItem>
  <FaqItem q='Saving fails with "Bei einem Passwort ist E-Mail oder Username Pflicht".'>
    The message means: a password requires an email or username. Entries of the type **Passwort** need at least one account detail so it is clear what the password belongs to. Fill in the **E-Mail** or the **Username** field (one is enough) and save again. Alternatively another type may fit better, for example **Sichere Notiz** (secure note).
  </FaqItem>
  <FaqItem q="The import skipped some entries.">
    That is the duplicate detection: an entry is skipped when the combination of **title, URL, email and username** already exists in the vault. The import never overwrites existing entries. If you want to update an entry anyway, edit it directly in the vault; if it should exist twice, change one of the four fields in the CSV before importing.
  </FaqItem>
  <FaqItem q="The staff-logins dialog does not load.">
    Reload the page and open the dialog again. A bug that temporarily prevented the dialog from loading has since been fixed. If the problem persists, contact support.
  </FaqItem>
  <FaqItem q="I deleted an entry by accident.">
    Deleted entries move to the trash and remain restorable until the retention period ends. Your admin sets that period in the tool settings under **Papierkorb-Aufbewahrung** (trash retention, 30 to 365 days). Ask your admin to restore the entry. After the period ends, the entry is gone for good.
  </FaqItem>
</Faq>

## Further reading

Basics on levels, master password and 2FA: [Security](/tools/zugangsdaten-tresor/sicherheit). Everything about shares and links: [Sharing](/tools/zugangsdaten-tresor/teilen). Back to the overview: [Credentials vault](/tools/zugangsdaten-tresor).