Skip to main content
Your vault is your set of encryption keys. Cloud creates it the first time you open the app, and everything you store depends on it.

​
First run

1

Sign in

Sign in with your Mauvely account at cloud.mauvely.com. Cloud shares its sign-in with mauvely.com, so if you are already signed in there, you are signed in here.
2

Create your vault

Cloud derives a key from your account password, inside your browser, and uses it to protect a newly generated master key. Your password itself is never sent anywhere in a form that could reproduce this key.
3

Save your recovery phrase

You are shown 24 words. This is the second, independent way into your vault. Write it down on paper, or put it in a password manager — anywhere you would still have it if this computer were lost.Cloud then asks you to confirm a few of the words. It keeps prompting until you do.
There is no third copy. Mauvely cannot reset your way into your files, cannot recover your phrase, and cannot decrypt anything on your behalf. Any of those would require a key we hold, which is exactly what we do not have.

​
Your password and your recovery phrase

They are peers. Two independent wrappings of the same master key:
  • Either one opens your vault.
  • Neither reveals the other.
  • Losing your password costs nothing if you have the phrase.
  • Losing the phrase costs nothing if you know the password.
  • Losing both is unrecoverable.
Changing your password re-wraps the master key under a new one — it does not re-encrypt a single file, so it is instant regardless of how much you have stored. The same is true of generating a new recovery phrase.

​
Unlocking on another browser

Sign in, then supply either your password or your 24-word phrase. Cloud rebuilds your keys locally and the vault opens. You can do this on as many browsers and devices as you like. Nothing is tied to one machine.
The 24 words come from the BIP-39 wordlist, which is designed so that no two words share their first four letters and a mistyped or transposed word is caught before you are told the phrase is wrong.It is not a cryptocurrency wallet phrase and cannot be used as one — Cloud does not use BIP-39’s key derivation, only its wordlist and checksum.

​
Trusting a device

By default your keys live only in the memory of the current tab, and you are asked for your password again next time. Trust this device keeps the key in the browser’s own key storage in a form that scripts cannot read back — the browser can use it to decrypt, but nothing can copy it out. Keys are never put in localStorage or sessionStorage, which hold plain strings that one line of injected script could steal. Only do this on a machine you control.

​
Auto-lock

After 30 minutes of inactivity, Cloud drops your keys from memory and returns to the locked state. It genuinely discards the keys rather than hiding the interface — walking away from an unlocked laptop does not leave your files readable indefinitely. Unlock with your password to carry on.

​
Your fingerprint

The Encryption page shows your public key fingerprint. It is the identity other Mauvely users see when you share with them, and it is what makes a substituted key detectable. If you are sharing something genuinely sensitive, confirm your fingerprint with the other person over a channel that is not Mauvely — a phone call, an in-person check. See Security.

​
Changing your password

Change it on mauvely.com. Cloud re-wraps your master key under the new password the next time you unlock. Because password strength now determines how well your files are protected — the password is the last place that secret exists — Cloud checks strength in the browser and will push back on a weak one.