Skip to content
telnety

Credential Vault

The vault is where Telnety stores SSH passwords, key passphrases, RDP credentials, VNC passwords, and arbitrary secure notes. It is encrypted on-device with AES-256-GCM. The server never sees plaintext. If you lose your master password, the vault is gone — we cannot recover it for you.

How encryption works

  • Cipher: AES-256-GCM with a random 96-bit nonce per entry.
  • Key derivation: Argon2id with m=64 MiB, t=3, p=4. Tuned to take ~250 ms on a modern laptop and to be GPU-hostile.
  • Per-entry salt: every vault entry carries its own 16-byte salt, so two identical secrets never produce identical ciphertext on disk.
  • Master password: known only to you. Telnety never transmits it, hashes it, or stores it.

Unlocking

On desktop and Android, the vault is locked at app start. Unlock with:

  • Master password: the password you set when first creating the vault.
  • Biometric (Android): the master key is wrapped by the Android Keystore and released after fingerprint/face verification. The wrap key never leaves the secure element.
  • OS keychain (desktop): opt-in. Wrap the master key with Windows Credential Manager, macOS Keychain, or Linux Secret Service so you don't retype every launch.

Auto-lock

The vault auto-locks after a configurable idle period — default 15 minutes. You can shorten this in Settings → Vault for shared machines, or extend it for trusted workstations. The vault always locks when the app process exits.

Cloud sync (Pro)

On Pro and higher, the vault syncs across your devices via app.telnety.com. The sync payload is the same ciphertext that lives on disk locally — we transport blobs, not secrets. The unlock key never crosses the network.

This means a successful breach of our database would yield ciphertext under your master password — useless without offline brute force against an Argon2id KDF. It also means we cannot help you recover a forgotten master password.

What lives in the vault

  • SSH passwords and key passphrases
  • SSH private keys (Ed25519, RSA, ECDSA)
  • RDP and VNC credentials
  • Sudo / root escalation passwords (used by jump-host chains)
  • Arbitrary secure notes (API tokens, license keys, etc.)

Recovery

There is no master-password reset. There is no recovery email. There is no support backdoor. If you forget the master password and don't have a paper backup, the vault is gone — you will need to re-add each credential by hand. We strongly recommend exporting an encrypted backup from Settings → Vault → Export and storing it somewhere offline.