From download
to your first vault.

Know what you are buying

CipherVault is editable React and TypeScript source code for a browser-local vault. It suits developers and technically comfortable buyers who can run npm commands or deploy static files, and who understand local storage and backups.

The package contains application source, an npm lockfile, build scripts, tests, a Windows launcher, English documentation, a fictional-data demo, SVG branding and dependency notices. The reviewed RC3 package also contains a compiled production build.

1. Install and open

Before you begin: install Node.js with npm, version 22.14 or later. A maintained LTS version is recommended. Internet is needed for the first dependency installation.

Windows — easiest route

1. Use Extract All on the downloaded ZIP. Do not run files inside the ZIP viewer.
2. Open the extracted folder containing package.json and START_CIPHERVAULT.cmd.
3. Double-click START_CIPHERVAULT.cmd. It selects the correct folder, installs missing dependencies and opens the browser.
4. Keep that terminal window open while using the local app. If the browser did not open, visit http://localhost:3000.

Windows, macOS or Linux — terminal route

Open a terminal in the folder containing package.json, then run:

npm start

Or use the standard two-step setup:

npm ci
npm run dev

Open http://localhost:3000 in a full browser tab. Stop the local server with Ctrl+C when finished. Use the same hostname and port each time: localhost and 127.0.0.1 have separate storage.

2. Make a first-run check

1. Create a master password you can keep safely. There is no reset-by-email or recovery backdoor.
2. Add a fictional login, such as alex@example.test, before storing personal information.
3. Lock the vault, unlock it and confirm that the entry is present.
4. Open Settings & Backup, download an encrypted JSON backup and save it separately from browser data.
5. Read the restore and password-change instructions. Backups exported before a password change retain their original password.

To test restoration, use a separate browser profile with fictional data. Restore replaces the destination vault; it is not a merge. Keep the original backup and confirm the restored entries.

3. Try the demo in two minutes

Open the temporary demo. No account or shared demo password is needed.

1. Search for Studio. Clear the search and try the Passwords, Cards, Notes and Identities filters.
2. Mark an entry as a favorite and switch between grid and list views.
3. Edit Studio workspace to see a fictional TOTP setup and login note. The key is public demo data, not a real account credential.
4. Open Generator and switch between password and passphrase modes.
5. Use Add sample, then Reset demo. Reloading also restores the original samples.

4. Capabilities and boundaries

No password recovery, autofill extension or hosted account service is included. Read the full privacy and security model before using real data.

5. Build for your own host

npm ci
npm run build

Upload the contents of dist/ to a trusted static HTTPS host. Keep all assets, documentation and notices. Do not upload source environment secrets, personal backups or node_modules.

The build generates CSP and other security headers. Your host must actually apply them: uploading security-headers.json alone does not enable headers. Read the deployment guide for cache rules, header configuration and subdirectory hosting. HTML-rewriting features can invalidate the generated CSP hashes.

Node.js is needed to build the source, not to serve the resulting static files. Keep a stable origin; export a backup before changing domains, protocol or ports. Do not use a public marketing-demo origin as a personal vault installation.

6. Common setup issues

Missing script: dev

Your terminal is probably in the wrong folder. Open the folder containing this project's package.json, or use the Windows launcher.

“vite” is not recognized

Run npm ci in that project folder, then npm run dev. The npm start route installs missing dependencies automatically.

Port 3000 is already in use

Stop the earlier local server with Ctrl+C. Then run npm start again. Do not switch ports unintentionally: storage is origin-specific.

Blank screen or missing assets

Use localhost/HTTPS and a full browser tab. Check the terminal and browser console. For development, stop the server and try npm run dev:fresh. On a host, verify all build files and CSP headers. Do not clear browser storage to troubleshoot a vault containing data.

My entries disappeared after changing the address

Return to the original scheme, hostname, port and browser profile. Each origin/profile has its own storage. Use a verified encrypted backup to transfer intentionally.

See the full troubleshooting table for restore, TOTP, permissions and storage errors.

7. Support scope

Included: questions about documented installation and existing features, help reproducing defects in the supplied version, and investigation with a fix or workaround where feasible. Supported environments require the browser APIs listed above; exact tested versions are recorded in the package's docs/TEST_RESULTS.md. Safari/iPhone and manual assistive-technology coverage remain separate review work.

Outside scope: custom features/redesigns, translation, integrations, hosting administration, installation performed for you, debugging modified source, password/data recovery, security audits and compliance certification. Separate work requires a separate agreement if offered.

No guaranteed response time, 24/7 availability, lifetime updates or unannounced feature roadmap is promised. Support duration follows the published item terms at purchase; marketplace requirements and statutory rights still apply.

Contact the author through the marketplace item where you purchased the product. Include your version, browser/OS, Node/npm version when relevant, exact error and reproducible steps with fictional data.

Use is governed by the chosen marketplace license. Required third-party licenses and notices remain applicable. This guide does not grant source redistribution or resale rights.