A vault protects stored information
A vault is for reusable sensitive information. Unlocking it makes that information available for the permitted work; it is not the same as logging in to LeapTerm or authenticating to an SSH server.
A saved host profile can exist without a saved password. An account can be signed in while its vault remains locked. A private key may also have a passphrase independent of the vault password.
Set up and use a vault
- Open Keys & Security or the vault setup shown when saving a reusable secret.
- Check whether you are using local credential storage, a native Account Vault or a hosted workspace. Where available, Open Account Vault provides its setup and enrollment flow; Save hosts in Account Vault selects its separate saved-host catalog.
- Use a long, unique passphrase and retain the recovery material offered by that workflow.
- Unlock the correct vault before saving or using credentials.
- Lock it when you finish, especially on a shared or unattended device.
The native device credential store needs available operating-system secure storage. If the keyring is locked or unavailable, resolve that problem rather than placing private material in ordinary settings or text files.
Selecting Save hosts in Account Vault leaves existing device hosts and credentials in their current storage. Unlock the selected account's enrolled vault before accessing its saved hosts. See cloud and offline data for synchronization and pending-change controls.
If a saved credential reports that it cannot be safely restored, re-enter it and save the connection again. Successful account sign-in does not make an old credential usable in another storage scope.
Device unlock and recovery are different
Biometric or passkey-assisted options depend on the actual platform and enrollment. A convenient device unlock method is not a substitute for a tested recovery path. Device-bound material may not be exportable or usable on a replacement device.
Native Account Vault password unlock requires both the Vault password and Account Secret. Account sign-in with a passkey is separate from Unlock with passkey; the latter must be supported and enrolled for that vault on the device. If device unlock needs enrollment again, use the vault password and Account Secret before enabling it again.
Account recovery alone does not necessarily decrypt a vault. Keep the account secret, recovery kit or other material required by your specific vault workflow separate from the device it protects.
See backup and recovery before you need it, and cloud and offline storage before changing residency. Encryption at rest does not protect usable secrets from every threat while the client or endpoint is compromised and unlocked.