> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mauvely.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up your vault

> Create your Mauvely Cloud encryption keys, save your recovery phrase, unlock on a new browser, and understand device trust and auto-lock.

Your **vault** is your set of encryption keys. Cloud creates it the first time you open the app,
and everything you store depends on it.

## First run

<Steps>
  <Step title="Sign in">
    Sign in with your Mauvely account at [cloud.mauvely.com](https://cloud.mauvely.com). Cloud
    shares its sign-in with mauvely.com, so if you are already signed in there, you are signed in
    here.
  </Step>

  <Step title="Create your vault">
    Cloud derives a key from your account password, **inside your browser**, and uses it to protect
    a newly generated master key. Your password itself is never sent anywhere in a form that could
    reproduce this key.
  </Step>

  <Step title="Save your recovery phrase">
    You are shown **24 words**. This is the second, independent way into your vault. Write it down
    on paper, or put it in a password manager — anywhere you would still have it if this computer
    were lost.

    Cloud then asks you to confirm a few of the words. It keeps prompting until you do.
  </Step>
</Steps>

<Warning>
  **There is no third copy.** Mauvely cannot reset your way into your files, cannot recover your
  phrase, and cannot decrypt anything on your behalf. Any of those would require a key we hold,
  which is exactly what we do not have.
</Warning>

## Your password and your recovery phrase

They are peers. Two independent wrappings of the same master key:

* Either one opens your vault.
* Neither reveals the other.
* Losing your password costs nothing if you have the phrase.
* Losing the phrase costs nothing if you know the password.
* Losing both is unrecoverable.

Changing your password re-wraps the master key under a new one — it does not re-encrypt a single
file, so it is instant regardless of how much you have stored. The same is true of generating a new
recovery phrase.

## Unlocking on another browser

Sign in, then supply either your password or your 24-word phrase. Cloud rebuilds your keys locally
and the vault opens.

You can do this on as many browsers and devices as you like. Nothing is tied to one machine.

<Note>
  The 24 words come from the BIP-39 wordlist, which is designed so that no two words share their
  first four letters and a mistyped or transposed word is caught before you are told the phrase is
  wrong.

  It is **not** a cryptocurrency wallet phrase and cannot be used as one — Cloud does not use
  BIP-39's key derivation, only its wordlist and checksum.
</Note>

## Trusting a device

By default your keys live only in the memory of the current tab, and you are asked for your
password again next time.

**Trust this device** keeps the key in the browser's own key storage in a form that scripts cannot
read back — the browser can use it to decrypt, but nothing can copy it out. Keys are never put in
`localStorage` or `sessionStorage`, which hold plain strings that one line of injected script could
steal.

Only do this on a machine you control.

## Auto-lock

After **30 minutes** of inactivity, Cloud drops your keys from memory and returns to the locked
state. It genuinely discards the keys rather than hiding the interface — walking away from an
unlocked laptop does not leave your files readable indefinitely.

Unlock with your password to carry on.

## Your fingerprint

The **Encryption** page shows your public key fingerprint. It is the identity other Mauvely users
see when you share with them, and it is what makes a substituted key detectable.

If you are sharing something genuinely sensitive, confirm your fingerprint with the other person
over a channel that is not Mauvely — a phone call, an in-person check. See
[Security](/cloud/security#sharing-with-a-named-person).

## Changing your password

Change it on mauvely.com. Cloud re-wraps your master key under the new password the next time you
unlock.

Because password strength now determines how well your files are protected — the password is the
last place that secret exists — Cloud checks strength in the browser and will push back on a weak
one.