Skip to main content
Vault items are the records you want beneficiaries to recover later. They can be text records, passwords, notes, crypto keys, documents, or files.

​
Encryption path

Eternum encrypts vault content in your browser before upload.
1

Derive the master key

Your browser derives a master key from your PIN or password with Argon2id.
2

Generate an item key

Each item gets its own data encryption key.
3

Encrypt content

The item content is encrypted with AES-GCM. The server receives ciphertext only.
4

Store metadata and blob data

Metadata is stored in PostgreSQL. The item name is encrypted client-side before upload, so the server stores only ciphertext for it; the item type is stored as plaintext. Encrypted file blobs are stored in object storage.

​
Item limits by plan

If you hit your plan limit, the app shows an upgrade prompt from the vault item creation flow.
Do not store the only copy of your credential in the vault. You need the credential to decrypt the vault before recovery.