Vault and Credentials

Vault and credentials

English · Русский

Everything Skerry stores — hosts, groups, keys, passwords, certificates, known hosts, snippets, runbooks, tunnels, settings, terminal history — lives in one encrypted vault file on the device.

The master password

Argon2id (m=64 MiB, t=3, p=4) stretches the master password into the master key, which unwraps the data key that encrypts records (XChaCha20-Poly1305, libsodium). Neither the password nor the derived keys leave the device, and there is no recovery: lose the master password and the data is gone. If sync is enabled, this is also the account password.

While the vault is locked the data key is not in memory and no record can be read.

Keychain categories

Category	What it holds
Keys	private keys generated in the app or linked from a file on disk
Passwords	host and login passwords; every copy is written to the usage log
Certificates	SSH certificates imported from a file, paired with their key
Known hosts	host keys you have accepted, plus the CAs trusted to vouch for host keys

A secret's card shows its algorithm, fingerprint, validity window (for certificates), which hosts depend on it, and when it was last used. Secrets can be filed into folders like hosts are.

Keys referenced from a file are re-read on each connection instead of being stored — that is how short-lived CA-issued certificates keep working. File-backed keys are deliberately excluded from sync: the file is device-local and a path means nothing on another machine.

Locking

• Auto-lock (Settings → Security) locks the vault when your input stops. A running transfer or script defers it by up to ten intervals; locking closes open sessions.
• Lock now — Ctrl+Shift+L / ⌘L.
• Biometric unlock (Android) unlocks with a fingerprint instead of the master password. The key binding is reported honestly: where the device offers only a weaker binding, the settings row says so.

Trash

Deleted hosts, keys, snippets and tunnels go to Settings → Trash and are removed for good after 30 days. Restore puts a record back; Delete forever and Empty trash are irreversible. The trash is part of the vault, so it is restorable on every synced device.

Security log

Settings → Security keeps a log of security-relevant moments: password changes, biometric enrollment, secret copies, key changes on hosts. It is stored in the vault like everything else.

Copying secrets

Copying a password requires authorization (biometric or master password, depending on the platform) and is recorded. On desktop the clipboard copy uses the platform's sensitivity hint and a clear timer.

Export and backup

The vault file itself is the backup — copy it out of the config directory (Installation lists the path). Exporting a private key writes it as a private file (0600) through a temporary file, so a failed export never leaves a truncated key behind.

What sync sees

Nothing in plaintext. The server holds ciphertext records, the wrapped data key and sync metadata — see Sync and devices and, for the mechanics, Vault and crypto.