A local vault.
A clear way to run it.

1. Quick start

Windows shortcut: extract the complete project, then double-click START_CIPHERVAULT.cmd beside package.json. With Node.js installed, it selects the correct folder, installs missing dependencies and opens the app. Keep the terminal open. First installation needs internet.

Any platform: run npm start in the project folder for guided startup. Manual setup is also supported below.

1. Install a maintained Node.js release meeting >=22.14.0, with npm. Node 22 or 24 LTS is recommended for development. Open the source directory in VS Code.
2. Open a terminal in the directory containing package.json.
3. Install the exact versions recorded in the lockfile, then start development:

npm ci
npm run dev

Open http://localhost:3000. Select Open Vault and create a long, unique master password. Keep it somewhere safe. The application cannot recover it.

For a tour of the interface with editable temporary sample data, open /demo.html. Demo changes reset on reload. Never put real secrets into the demo.

2. Requirements & product scope

Use a maintained Chrome, Edge, Firefox or Safari with JavaScript, secure-context Web Crypto, Web Locks and local browser storage enabled. The app checks these capabilities before opening password forms. HTTPS is required outside localhost. Clipboard access and printing depend on browser permissions.

This is a React/TypeScript application delivered as static website assets. There is no hosted account, cloud sync, admin panel, autofill extension, biometric unlocking, password recovery service, QR scanner or service-worker offline cache. After the app has loaded, most vault operations run locally; a fresh offline page load is not guaranteed.

The current format is v6. Backups are limited to 8 MiB and 5,000 items; browser storage quota may be smaller. This product is intended for personal browser vaults, not centralized enterprise credential administration.

3. Everyday use

Create and organize entries

Use Add to create a login, card, note or identity. Choose a category, mark favorites, and use search, type filters, sorting, or grid/list view. Labels may be trimmed; secret text preserves whitespace and Unicode. Validation errors keep the draft available for correction. Closing an edited form asks whether to discard the draft. Locking closes drafts immediately.

Generate passwords and TOTP codes

The generator uses the browser's cryptographic random source. Passwords can be 8–128 characters; passphrases use 4–10 words from the EFF Large Wordlist. Strength estimates are local heuristics, not a guarantee or a breach test. Estimates are unavailable for inputs over 128 UTF-16 code units; long values are not truncated.

For TOTP, paste a Base32 key or otpauth://totp/ URI into a login entry. SHA1, SHA256 and SHA512, 6/8 digits and periods of 1–300 seconds are supported. Keep the device clock correct. Finish enrollment on the original service. Removing the stored key does not disable 2FA on that service. Storing a password and its TOTP key together reduces factor separation.

Lock, reveal and clipboard

Use Lock or Ctrl+Shift+L (Cmd+Shift+L on macOS). Settings offers inactivity periods of 1, 5, 15 or 30 minutes. Revealing an entry requires the master password again. Editing and copying are available during an unlocked session. Auto-lock timers may be suspended by the browser; expiry is checked on resume.

Clipboard clearing can be set to 15, 30 or 60 seconds, or disabled. It is best effort and only clears a clipboard value still matching the app's copy. It cannot erase operating-system clipboard history. Copy only when needed.

Watchtower

Local checks identify weak/reused passwords and missing stored TOTP keys. They do not verify remote account security. The optional online breach check queries Have I Been Pwned only when requested; see the privacy section before using it.

4. Backup, restore & password changes

1. Open Settings → Export JSON. Confirm that the downloaded encrypted file exists and store a second copy in a safe place.
2. Remember the password in use when each backup was created. A download-request timestamp is not proof of a saved or usable backup.
3. To restore, select Restore encrypted backup on the starting/locked screen, or Import File in Settings. Choose a v5/v6 JSON backup and enter that backup's master password.
4. Verify first. Nothing is replaced by verification alone. When a vault already exists, request a current backup and confirm replacement before restoring.
5. Unlock the restored vault and check its contents. Keep a known-good copy before deleting older files.

Changing the master password re-encrypts the current vault, then locks it. Export a fresh backup afterward. Older downloads remain decryptable using their old password; changing the current password cannot revoke them.

The printable emergency sheet is a blank template. Write the exact password, installation address and backup location by hand, then store the sheet securely. It does not generate a recovery key and cannot recover a forgotten password.

Reset Vault permanently erases only this installation's CipherVault browser keys. Type DELETE and acknowledge the loss. It is available while locked because local reset is deletion, not recovery. A damaged-vault rescue download contains raw stored data for diagnosis; it is not a normal restore file.

5. Plaintext CSV export

CSV export requires your master password and explicit acknowledgement. It includes readable passwords, TOTP keys, cards, notes and identities. Use a trusted destination and remove unneeded copies.

CipherVault CSV can be imported with the matching export mode. Use encrypted JSON for backups: CSV contains readable secrets.

Import passwords from CSV

Open Settings → Import CSV, select the format and a file, then choose Preview import. Names and item types are shown; passwords, notes and account details stay hidden. Previewing does not write to storage. All processing happens in this browser.

• Chrome password CSV: UTF-8, comma-separated, with name,url,username,password headers. Optional note becomes login notes. A title, username and password are required for each record. Website addresses must be HTTP(S) or empty. Unsupported columns or record types are rejected; Android-app URLs and passkeys are not supported.
• CipherVault exact values: import an unmodified exact-mode export. Leading apostrophes and secret whitespace are preserved.
• CipherVault spreadsheet mode: import an unmodified spreadsheet-mode export. Exactly one text-prefix apostrophe is removed from each non-empty cell. Choose the matching mode explicitly; it is not guessed.

Files are limited to 4 MiB and 5,000 items. The merged vault must also fit the 5,000-item limit and your browser's storage quota. Quoted commas, escaped quotes, Unicode and multiline fields are supported. The preview shows at most 50 names and 50 errors; every record is checked. Record numbers count CSV records including the header, not physical lines inside quoted notes.

Fix every error before importing. Identical entries are skipped by default, including repeated entries inside the file. Matching compares type, category, favorite and all content fields, ignoring IDs and dates. Accounts with different passwords stay separate. You can explicitly keep identical items. Existing entries are never replaced, and imported entries receive new IDs.

Close the dialog or lock the vault to cancel before the atomic write. If another tab changes the vault, unlock and preview again. Failed storage writes leave the old vault intact. After a successful import, use Edit to review notes and account details. Login notes are hidden on cards until password reveal is authorized.

6. Privacy & security model

Vault entries and their item metadata are encrypted as one AES-256-GCM payload in this browser's localStorage. New vaults use PBKDF2-SHA256 with a random 32-byte salt and 600,000 iterations. Encryption uses fresh 96-bit IVs. Passwords are not sent to an application backend. KDF parameters, encrypted verifier, revision and local settings remain outside the encrypted payload.

The hosting server sees ordinary requests for website assets and may maintain access logs. The application has no analytics or remote font dependency. An online breach check sends the first five hexadecimal characters of each password's SHA-1 hash to api.pwnedpasswords.com, with padded range responses requested. It does not send the plaintext or complete hash. The provider still sees connection metadata such as IP address. A missing match does not prove a password is safe.

There is no independent security certification. A stolen encrypted vault can be attacked offline; the UI's brief failed-login cooldown is not an offline-attack defense. Strong master passwords and protected backups are essential. Private browsing, storage eviction and clearing site data can delete your only local copy.

Web Locks and revision checks coordinate writes between current app tabs. Another tab changing the vault locks stale sessions. Close old application versions before upgrades. Valid older backups can be replayed; there is no remote anti-rollback authority.

7. Build & deploy

npm run check
npm run preview

check runs TypeScript, unit tests and a production build. Stop the dev server before previewing, because both use localhost:3000. Browser tests are separate:

npx playwright install chromium
npm run test:e2e

Upload the contents of dist to a static HTTPS host, retaining assets/, help/, demo.html and third-party-notices.txt. Never deploy source credentials, node_modules, development servers or real vault backups. No server environment secret is required. A Vite environment variable is public client configuration, not a secret store.

Security headers

The build generates dist/_headers and dist/security-headers.json. The CSP includes hashes of the exact inline startup recovery code. Hosts supporting the Netlify/Cloudflare Pages-style _headers format can use that file. For Nginx, Apache or another host, configure equivalent response headers from the JSON; uploading JSON alone does not activate them. npm run preview also does not apply these headers automatically.

Rebuild and redeploy headers together whenever HTML changes. Avoid host-side HTML rewriting that changes inline script/style bytes. Serve HTML with Cache-Control: no-cache, hashed assets with long immutable caching, and correct JavaScript/CSS MIME types. Keep old hashed assets during rollout so existing open tabs can finish loading. HTTPS, certificate renewal and server patches are the operator's responsibility.

Subdirectory hosting

For a deployment such as https://example.com/vault/, build with the correct base path:

npx vite build --base=/vault/
node scripts/build-security.mjs
npm run verify:build

Upload dist inside that directory. The generated header rules follow the configured base automatically. Verify the cache rules for /vault/assets/* and HTML on your host. The application has no history-based routes; serve actual files and directory indexes. Never rewrite a missing JavaScript file to index.html.

Public preview

Use /demo.html for a sample-only marketplace preview. The demo does not read or write the real vault's storage. Serve help publicly at /help/. The supplied frame policy allows the CodeCanyon preview origin; if an embedded browser blocks storage, open the actual vault in a full tab. Hosting or publishing these URLs is a separate owner action.

8. Customize the source

The original vector logo is public/brand/ciphervault-mark.svg. Replace that asset to change the mark across the navigation, intro, empty vault, demo and favicon. src/components/BrandMark.tsx handles the deployment base path. Keep a square viewBox and test readability at 16, 32 and 40 pixels. See docs/BRANDING.md for the complete branding map.

Change product labels in the components, document title in the HTML entries, and colors in CSS/Tailwind classes. Check 320px mobile layouts after modifying long labels. Preserve third-party attributions.

Do not rename storage keys or alter encryption/backup formats casually: existing users need a verified migration path. Re-run checks and browser tests after behavior changes. Keep test fixtures fictional and avoid logging secrets.

9. Updating an installation

1. Export and verify a backup. Record the existing installation address and version.
2. Close other CipherVault tabs. Keep a copy of the previous build and headers.
3. Review CHANGELOG and migration notes, install dependencies with npm ci, and build.
4. Deploy assets, HTML and matching headers as a single release. Reopen at the same origin.
5. Unlock, check representative entries and export a new backup. v5 data is migrated only after successful verification.

Do not downgrade a migrated v6 vault to a v5-only app. A failed storage write keeps the previous canonical document. A deployment rollback cannot undo a user's successful password change or vault mutation; use a backup and its corresponding password when restoring data.

10. Troubleshooting

11. Support & credits

See the buyer support scope for included assistance, supported environments and exclusions.

For support, contact the product author through the marketplace item page after purchase. Include version, browser/OS, installation URL scheme and reproducible steps with fictional data. Never send your master password, real secrets, plaintext CSV or personal vault backup.

Core libraries include React, Lucide and zxcvbn-ts. Passphrases use the EFF Large Wordlist; English strength data includes upstream OPUS/OpenSubtitles attribution. Read the included licenses and required notices. No listed organization endorses CipherVault.