Setting up your vault

Your vault is your set of encryption keys. Cloud creates it the first time you open the app, and everything you store depends on it.

First run

1. 1
   Sign in

   Sign in with your Mauvely account at cloud.mauvely.com. Cloud shares its sign-in with mauvely.com, so if you are already signed in there, you are signed in here.

2. 2
   Create your vault

   Cloud derives a key from your account password, inside your browser, and uses it to protect a newly generated master key. Your password itself is never sent anywhere in a form that could reproduce this key.

3. 3
   Save your recovery phrase

   You are shown 24 words. This is the second, independent way into your vault. Write it down on paper, or put it in a password manager — anywhere you would still have it if this computer were lost.

   Cloud then asks you to confirm a few of the words. It keeps prompting until you do.

Your password and your recovery phrase

They are peers. Two independent wrappings of the same master key:

• Either one opens your vault.
• Neither reveals the other.
• Losing your password costs nothing if you have the phrase.
• Losing the phrase costs nothing if you know the password.
• Losing both is unrecoverable.

Changing your password re-wraps the master key under a new one — it does not re-encrypt a single file, so it is instant regardless of how much you have stored. The same is true of generating a new recovery phrase.

Unlocking on another browser

Sign in, then supply either your password or your 24-word phrase. Cloud rebuilds your keys locally and the vault opens.

You can do this on as many browsers and devices as you like. Nothing is tied to one machine.

Trusting a device

By default your keys live only in the memory of the current tab, and you are asked for your password again next time.

Trust this device keeps the key in the browser’s own key storage in a form that scripts cannot read back — the browser can use it to decrypt, but nothing can copy it out. Keys are never put in localStorage or sessionStorage, which hold plain strings that one line of injected script could steal.

Only do this on a machine you control.

Auto-lock

After 30 minutes of inactivity, Cloud drops your keys from memory and returns to the locked state. It genuinely discards the keys rather than hiding the interface — walking away from an unlocked laptop does not leave your files readable indefinitely.

Unlock with your password to carry on.

A trusted device does not auto-lock, and unlocks itself whenever Cloud is opened again. To stop that, choose Forget this device in Settings.

Your fingerprint

The Encryption page shows your public key fingerprint. It is the identity other Mauvely users see when you share with them, and it is what makes a substituted key detectable.

If you are sharing something genuinely sensitive, confirm your fingerprint with the other person over a channel that is not Mauvely — a phone call, an in-person check. See Security.

Changing your password

Change it on mauvely.com. Cloud re-wraps your master key under the new password the next time you unlock.

Because password strength now determines how well your files are protected — the password is the last place that secret exists — Cloud checks strength in the browser and will push back on a weak one.