Security and recovery
The vault is encrypted in your browser. The server moves encrypted blobs and never sees a credential in the clear, not even the password you sign in with.
The three keys
Your vault opens with any one of these three. Lose one and you still get in with the others:
- Your password.
- Your 24-character recovery code, shown once, when you create your first folder.
- A device passkey, if you turned it on.
Quick access with fingerprint or face
It replaces both the password and the app code with a single gesture. You can register several devices, each with its own name, and delete any of them.
The server sees none of it: it only moves an encrypted blob that only that device can open, and verifies a signature.
The recovery code
It appears once, when you create your first folder. Download it and keep it away from the computer you work on. It is the second key to your vault: without it, a forgotten password leaves the vault shut.
What SHTERA cannot do
We cannot read your credentials. There is no plaintext copy anywhere, and no "admin mode" that reveals them.
Keep your recovery code. It is the difference between forgetting a password and losing the vault.
