Export, password and Secret Key
Export your codai Vault to a file other password managers can read, change the vault password, and replace the Secret Key and the recovery kit. All three are done in the hub.
Export and the password change are in the hub, on the Settings tab of the unlocked vault. The desktop and phone apps do not have them.
Both ask for two things before they start:
- a sign-in to your codai account that is less than 15 minutes old. Otherwise the hub answers "For your security, confirm it's you first: your sign-in is older than 15 minutes." and offers to sign you in again;
- proof that you can open the vault, typed in the dialog: the vault password and the Secret Key. For a password change, the recovery code also works.
Export
The exported file is not encrypted
Anyone who can open the file can read every password in it. Save it to a place only you can reach, import it where you need it, then delete it. Remember the copy in your downloads folder and in any cloud backup of that folder.
- Open Settings and choose Export….
- Choose the Format:
- Bitwarden JSON (unencrypted) keeps every field. Bitwarden and most other password managers can import it.
- CSV (Bitwarden columns) is for spreadsheets and simple importers.
- Under Vaults to export, tick the vaults you want. Each one shows how many items it adds. Shared vaults you cannot export are named below the list.
- Read the summary. It says how many items will be exported and how many are left out, and why.
- Type the Vault password and the Secret Key, tick I understand that the file is not encrypted, and choose Download export.
The file is named codai-vault-export- followed by the date. It is built in your browser from the items you already unlocked. codai receives only the format, which vaults you exported and the number of items, and records Vault exported in Activity. If that record cannot be written, nothing is exported.
A shared vault can be exported only by its Owner or a Manager, and the owner of the vault sees the export in their own Activity, with the name of the member who exported and the number of items.
What is in the file
| Item type | In the file |
|---|---|
| Login | A login: websites, username, password and the one-time code key |
| Secure note | A note |
| Card, Identity | A card or an identity in JSON; a note with the values as fields in CSV |
| API key, .env, SSH key, OAuth token | A note with the values as fields; secret values are hidden fields |
| Tags | A field named tags |
| Vault | A folder with the name of the vault |
What is not in the file
- Passkeys. The private key of a passkey never leaves the vault. To move to another manager, create a new passkey there on each site.
- Files.
- Honeytokens. Decoy items are left out and not counted.
- Items the browser could not decrypt.
- Agent access, policies, the activity log and emergency contacts. They are not part of an item.
CSV changes some values
In CSV, a value that starts with =, +, - or @ gets an apostrophe in front, so that a spreadsheet does not run it as a formula. The dialog tells you how many values were changed. A value with several lines, such as an SSH key, is moved to the notes of its row.
Choose JSON when you need every value exactly as stored.
Change the vault password
Every password change replaces your recovery code
You save a new recovery kit before anything changes. Once the change is saved, the recovery code on your old kit no longer opens the vault: the new kit is the only valid one.
- Open Settings and choose Change password….
- Under First, prove it's you, use one of the two tabs:
- Password: the Current vault password and the Current Secret Key;
- Recovery code: the code from your recovery kit. Use this when you forgot the password.
- Type the New vault password twice. The same rule as at setup applies: at least 50 bits, about four random words.
- Decide about Also create a new Secret Key, see below. It is on when the dialog opens.
- Choose Continue. The dialog shows Save your new recovery kit, with your new recovery code and the Secret Key (the new one, or the one you keep). Download the kit, choose Print or choose Copy kit, type the Last 4 characters of the Secret Key from the copy you saved, and choose Change password. Until you do, nothing has changed.
Everything is computed in your browser. codai receives your account's encrypted keys, never the password, the Secret Key or the recovery code.
What changes and what does not
| Changes | Stays the same |
|---|---|
| The password you type in the hub, in the browser extension and on a new device | Devices that open the vault with fingerprint, face or Windows Hello: they keep working |
| Your recovery code. The code on your old kit stops working | Your items. They are not encrypted again |
| The Secret Key, if you chose a new one. The old one stops working | A vault that is already open on another device stays open until it locks |
| The Secret Key remembered in this browser is updated |
A password change does not remove a device
A phone or a PC you already set up keeps its own way to open the vault. If you lost a device, sign it out of your codai account under Security → Devices, so that it can no longer download the vault, and revoke it on the Devices tab of the vault.
A new Secret Key
Create a new Secret Key when someone else may have seen the key. You always change the password at the same time.
If your whole recovery kit was seen, create a new Secret Key as well. The password change replaces the recovery code that was on that kit and the new Secret Key replaces the key, so nothing on the old kit opens the vault any more.
- With the Password tab you can keep the Secret Key or create a new one.
- With the Recovery code tab a new Secret Key is always created: the hub cannot check the old one without your password.
Your kits afterwards
- Every change gives you a new kit. It holds the new recovery code and the Secret Key that is valid from now on: the new one, or the one you kept.
- Once the change is saved, the new kit is the only valid one. The recovery code on the old kit no longer works, and neither does its Secret Key if you created a new one. Destroy the old kit.
If the change does not go through
The last screen always says which password and which kit are valid.
- The screen says that nothing was saved: your current password and your old kit still open the vault. This happens when the change did not reach codai, when the unlock methods changed on another device meanwhile, or when your sign-in got older than 15 minutes. Where the dialog offers Try again, it saves the same new password, the same Secret Key and the same new recovery code, so the kit you already saved stays the right one. If you close the dialog instead, destroy the new kit: it is not valid.
- The screen says that the hub could not confirm whether the change was saved: until you know, either the old password and kit or the new ones may be valid. Keep both kits until you can unlock the vault, and choose Check again.
What you cannot do
- Replace only the recovery code. You get a new recovery code by changing the password. To keep your password, type it again as the new one and leave Also create a new Secret Key on.
- Delete the vault as a whole. You can delete its items one by one.
- Export or change the password from the desktop or phone apps.
Agents and approvals
Let an agent use a credential from the codai Vault without seeing its value. Expose an item with a handle and allowed hosts, approve requests on your phone, watch, desktop or in the hub, and set decoy items that raise an alarm.
Vault troubleshooting
What to do when the codai Vault does not open, when a save is refused because the item changed or was deleted on another device, and when a change takes time to show up on your other devices.