# Vault (/docs/vault) The codai Vault keeps passwords, passkeys, API keys and other secrets encrypted on your devices and lets agents use them without seeing the values. This page says what works where and what codai can and cannot see. The codai Vault is the password and passkey manager built into codai. It stores logins, passkeys, API keys, notes and other secrets, syncs them between your devices, offers them to other apps, and lets an agent use a credential through a handle without seeing its value. You create the vault once in the hub, at [hub.codai.ro/vault](https://hub.codai.ro/vault), and then open it on your other devices. ## What works where [#what-works-where] | You want to | Hub (browser) | Desktop (Windows) | Android (APK from GitHub) | iPhone | `codaid` (terminal) | | ---------------------------------------- | ------------- | ---------------------- | ------------------------- | -------------------- | ------------------- | | Create the vault | Yes | No | No | No | No | | Read, show and copy items | Yes | Yes | Yes | Yes | Handles only | | Add and edit items | 8 item types | Login, Note, API key | Login, Note, API key | Login, Note, API key | No | | Delete an item, with Undo | Yes | Yes | Yes | Yes | No | | Use passwords and passkeys in other apps | No | Passkeys (Store build) | Passwords and passkeys | No | No | | Import from another password manager | Yes | No | No | No | Yes | | Export, change the vault password | Yes | No | No | No | No | | Approve agent requests | Yes | Yes | Yes | Standard requests | No | The codai app from Google Play does not include the vault: its Vault screen points you to the hub and to the desktop app. A Wear OS watch can approve standard agent requests. ## What codai can and cannot see [#what-codai-can-and-cannot-see] Every item is encrypted on your device before it is uploaded: in your browser when you use the hub, inside the app on desktop, Android and iPhone. The key that opens the vault is derived on the device from your vault password and your Secret Key. Neither of them is sent to codai. codai's servers store the encrypted items and deliver them to your devices. **codai cannot read:** - the content of an item: title, username, password, websites, notes, tags, files and the private key of a passkey; - the names of your vaults; - your vault password, your Secret Key and your recovery code. **codai can read**, because it is stored unencrypted next to each item so that sync and agents work: - the type of each item (login, passkey and so on), a version counter, and when the item was created, changed, last used and deleted; - whether an item is marked as a honeytoken; - for an item you expose to agents: its handle, the name you chose to show to agents, the sensitivity, the allowed hosts and the name of the environment variable; - every agent request and your answer to it: the agent, the item, the host, the command or call it wants to make and the purpose it gave. This is the activity log. Values are never part of it; - the devices you enrolled for approvals, and who is a member of a shared vault. ### The exception: items usable in the cloud [#the-exception-items-usable-in-the-cloud] An item can get a **second copy that codai's servers can open**. For that, a device sends the decrypted item once, over an encrypted connection, and the server seals it at once with a key held by codai. With that copy the servers can use the item for your agents while none of your devices is unlocked. They open it only after your policy allowed the request. - It is **off by default**, and it is decided item by item. - Only the owner of the vault can turn it on. - No codai app has a switch for it today. It is set through the API (`PUT /v1/vault/items/{id}/cloud`) or the SDKs. - The hub marks such an item **Usable in the cloud**, and the **Activity** tab records **Cloud use enabled** and **Cloud use disabled**. - The copy is removed when you delete the item and every time its content changes. The desktop and Android apps send a new copy after an edit. The hub and the iPhone app do not, so an edit made there turns cloud use off for that item. For an item with a cloud copy, codai is technically able to read the content. For every other item it is not. Without a cloud copy, an agent can use an item only through a codai app on your own machine: the desktop app with the vault unlocked, or `codaid` on a machine you enrolled. That app decrypts the item locally and hands the value to the command, not to the agent. ## Good to know [#good-to-know] - **Nobody can reset your vault password.** If you lose the password, the Secret Key and the recovery code, the vault cannot be opened by anyone. See [Set up your vault](./set-up.mdx). - **Locking.** The hub locks after 10 minutes without activity or 5 minutes in a hidden tab. The desktop app locks after 15 minutes without use. The Android app locks 5 minutes after it goes to the background, the iPhone app as soon as it does. - **Clipboard.** A copied secret is cleared from the clipboard after 30 seconds in the hub, on desktop and on Android, and after 60 seconds on iPhone. - **Breach check.** The check on the **Health** tab hashes each password on your device and sends only the first 5 characters of the hash.