Vault module · User guide
Store passwords safely and share them deliberately
The Vault is a password manager that lives inside your FreeScout. The decisive difference to a note or a spreadsheet: everything is encrypted in your browser before it goes to the server, and only decrypted there again. What lies on the server is unreadable data.
That applies to us and to your administrator as well. Nobody with access to the server or the database can read your entries. That is the whole point — and it has a flip side you should know about: there is nobody who can reset a forgotten master password for you. Hence the next section.
Setting up the vault
When you open Vault in the navigation for the first time, you set a master password. From that password your browser derives the key that encrypts your entries. The master password itself never leaves the browser and is stored nowhere.
Three things in this single step decide whether you can still reach your data in two years:
Do take those five minutes. A password manager without a way back is convenient right up to the day you need one.
Creating and organising entries
You keep entries in folders, the way you know it from files. Each entry also gets one of thirteen types — the type determines which fields you are shown:
The type is not there for its own sake. For an SSH key you want fields for user, host and passphrase; for a credit card, number, expiry date and security code. A single field called «password» for everything means half the details end up in the note and nobody finds them again.
Letting passwords be generated
A login entry comes with a generator. You set length and character set, and it produces a random password.
The random numbers come from your browser's cryptographic function, not from a homemade formula. That is the difference between a password that looks random and one that is random.
One-time passwords, in the vault itself
A login entry can additionally hold a TOTP seed — the value a website shows you as a QR code or a string when you set up two-factor sign-in.
The Vault then displays the currently valid six-digit code live, with its own copy button. It works like an authenticator app, but it sits in the same place as the password it belongs to.
History and recycle bin
Every change to an entry automatically files a new version in its history. You can go back to an earlier one at any time — useful when a password has been changed but the old one is still needed somewhere.
Deleted entries first land in the recycle bin and can be restored from there. Only the second step removes them for good.
Shared vaults
Besides your personal vault you can create shared ones — one per customer, say, or one for the server credentials the whole team needs. You add members deliberately, each with one of three roles:
| Role | What it allows |
|---|---|
| Owner | full access, and managing members |
| Can edit | creating, changing and deleting entries |
| Can view | reading only |
The encryption remains in place: the key of a shared vault is wrapped individually for each member. Here too the server sees no content, only who is a member.
Handing an entry to someone outside
Sometimes access has to reach a person who has no FreeScout — a customer, an external technician. For that there is the sharing link for exactly one entry.
The link is protected by a separate six-digit PIN and expires after a period you choose. Send the PIN through a different channel than the link itself — the link by email, the PIN by phone or text. If both stand in the same message, the PIN protects nothing; whoever reads the message has both.
Printing the emergency kit
On the page with the recovery key you can produce a print-ready emergency kit. Paper is deliberate: a recovery key saved as a file on the same computer as the browser does not help when that computer is the problem.
Keep it where you keep contracts or identity documents.
Worth knowing
Reloading the page locks the vault
The decryption key lives only in your browser's memory, never on disk. That is why you have to enter the master password again after every reload. This is not sloppiness — it is exactly the reason a stolen computer does not give up your passwords.
A removed member does not lose access immediately
If you take someone out of a shared vault, their already cached access in the browser remains until the next key rotation. The rotation is a step you trigger yourself.
When someone leaves the company, or for a sensitive vault, carry it out deliberately — and do not assume that removing the member alone is enough.
A forgotten master password is final
Without the master password and without the recovery key, the entries cannot be opened any more. There is no back door, no administrator access and no way through us. That is the price of nobody else being able to read along either.
Not getting anywhere with this? Support