# Export, password and Secret Key (/docs/vault/export-password)

Export your codai Vault to a file other password managers can read, change the vault password, and replace the Secret Key and the recovery kit. All three are done in the hub.

Export and the password change are in the hub, on the **Settings** tab of the unlocked vault. The desktop and phone apps do not have them.

Both ask for two things before they start:

- a sign-in to your codai account that is less than 15 minutes old. Otherwise the hub answers "For your security, confirm it's you first: your sign-in is older than 15 minutes." and offers to sign you in again;
- proof that you can open the vault, typed in the dialog: the vault password and the Secret Key. For a password change, the recovery code also works.

## Export [#export]

<Callout type="warn" title="The exported file is not encrypted">
  Anyone who can open the file can read every password in it. Save it to a place only you can reach,
  import it where you need it, then delete it. Remember the copy in your downloads folder and in any
  cloud backup of that folder.
</Callout>

1. Open **Settings** and choose **Export…**.
2. Choose the **Format**:
   - **Bitwarden JSON (unencrypted)** keeps every field. Bitwarden and most other password managers can import it.
   - **CSV (Bitwarden columns)** is for spreadsheets and simple importers.
3. Under **Vaults to export**, tick the vaults you want. Each one shows how many items it adds. Shared vaults you cannot export are named below the list.
4. Read the summary. It says how many items will be exported and how many are left out, and why.
5. Type the **Vault password** and the **Secret Key**, tick **I understand that the file is not encrypted**, and choose **Download export**.

The file is named `codai-vault-export-` followed by the date. It is built in your browser from the items you already unlocked. codai receives only the format, which vaults you exported and the number of items, and records **Vault exported** in **Activity**. If that record cannot be written, nothing is exported.

A shared vault can be exported only by its **Owner** or a **Manager**, and the owner of the vault sees the export in their own **Activity**, with the name of the member who exported and the number of items.

### What is in the file [#what-is-in-the-file]

| Item type                           | In the file                                                            |
| ----------------------------------- | ---------------------------------------------------------------------- |
| Login                               | A login: websites, username, password and the one-time code key        |
| Secure note                         | A note                                                                 |
| Card, Identity                      | A card or an identity in JSON; a note with the values as fields in CSV |
| API key, .env, SSH key, OAuth token | A note with the values as fields; secret values are hidden fields      |
| Tags                                | A field named `tags`                                                   |
| Vault                               | A folder with the name of the vault                                    |

### What is not in the file [#what-is-not-in-the-file]

- **Passkeys.** The private key of a passkey never leaves the vault. To move to another manager, create a new passkey there on each site.
- **Files.**
- **Honeytokens.** Decoy items are left out and not counted.
- Items the browser could not decrypt.
- Agent access, policies, the activity log and emergency contacts. They are not part of an item.

### CSV changes some values [#csv-changes-some-values]

In CSV, a value that starts with `=`, `+`, `-` or `@` gets an apostrophe in front, so that a spreadsheet does not run it as a formula. The dialog tells you how many values were changed. A value with several lines, such as an SSH key, is moved to the notes of its row.

Choose JSON when you need every value exactly as stored.

## Change the vault password [#change-the-vault-password]

<Callout type="warn" title="Every password change replaces your recovery code">
  You save a new recovery kit before anything changes. Once the change is saved, the recovery code
  on your old kit no longer opens the vault: the new kit is the only valid one.
</Callout>

1. Open **Settings** and choose **Change password…**.
2. Under **First, prove it's you**, use one of the two tabs:
   - **Password**: the **Current vault password** and the **Current Secret Key**;
   - **Recovery code**: the code from your recovery kit. Use this when you forgot the password.
3. Type the **New vault password** twice. The same rule as at setup applies: at least 50 bits, about four random words.
4. Decide about **Also create a new Secret Key**, see below. It is on when the dialog opens.
5. Choose **Continue**. The dialog shows **Save your new recovery kit**, with your new recovery code and the Secret Key (the new one, or the one you keep). Download the kit, choose **Print** or choose **Copy kit**, type the **Last 4 characters of the Secret Key** from the copy you saved, and choose **Change password**. Until you do, nothing has changed.

Everything is computed in your browser. codai receives your account's encrypted keys, never the password, the Secret Key or the recovery code.

### What changes and what does not [#what-changes-and-what-does-not]

| Changes                                                                        | Stays the same                                                                         |
| ------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- |
| The password you type in the hub, in the browser extension and on a new device | Devices that open the vault with fingerprint, face or Windows Hello: they keep working |
| Your recovery code. The code on your old kit stops working                     | Your items. They are not encrypted again                                               |
| The Secret Key, if you chose a new one. The old one stops working              | A vault that is already open on another device stays open until it locks               |
| The Secret Key remembered in this browser is updated                           |                                                                                        |

<Callout type="warn" title="A password change does not remove a device">
  A phone or a PC you already set up keeps its own way to open the vault. If you lost a device, sign
  it out of your codai account under **Security → Devices**, so that it can no longer download the
  vault, and revoke it on the **Devices** tab of the vault.
</Callout>

## A new Secret Key [#a-new-secret-key]

Create a new Secret Key when someone else may have seen the key. You always change the password at the same time.

If your whole recovery kit was seen, create a new Secret Key as well. The password change replaces the recovery code that was on that kit and the new Secret Key replaces the key, so nothing on the old kit opens the vault any more.

- With the **Password** tab you can keep the Secret Key or create a new one.
- With the **Recovery code** tab a new Secret Key is always created: the hub cannot check the old one without your password.

**Your kits afterwards**

- Every change gives you a new kit. It holds the new recovery code and the Secret Key that is valid from now on: the new one, or the one you kept.
- Once the change is saved, the new kit is the only valid one. The recovery code on the old kit no longer works, and neither does its Secret Key if you created a new one. Destroy the old kit.

## If the change does not go through [#if-the-change-does-not-go-through]

The last screen always says which password and which kit are valid.

- The screen says that nothing was saved: your current password and your old kit still open the vault. This happens when the change did not reach codai, when the unlock methods changed on another device meanwhile, or when your sign-in got older than 15 minutes. Where the dialog offers **Try again**, it saves the same new password, the same Secret Key and the same new recovery code, so the kit you already saved stays the right one. If you close the dialog instead, destroy the new kit: it is not valid.
- The screen says that the hub could not confirm whether the change was saved: until you know, either the old password and kit or the new ones may be valid. Keep both kits until you can unlock the vault, and choose **Check again**.

## What you cannot do [#what-you-cannot-do]

- **Replace only the recovery code.** You get a new recovery code by changing the password. To keep your password, type it again as the new one and leave **Also create a new Secret Key** on.
- **Delete the vault** as a whole. You can delete its items one by one.
- Export or change the password from the desktop or phone apps.