Password Vault

The Password Vault is an add-on that keeps your logins, notes and one-time codes encrypted on your PC. Moymo cannot read it, and the master password is stored nowhere.

Install it from the Modules page; it adds a Vault place to the sidebar.

How it keeps things safe

• One file on your PC holds everything, encrypted with a key made from your master password (a slow, memory-hard function, Argon2id, so guessing is expensive) and a modern authenticated cipher (XChaCha20-Poly1305).
• The master password is not stored anywhere, not even in a hashed form Moymo could keep. If you forget it, nobody, including Moymo, can recover the vault.
• The vault is locked until you type the master password, and asks again each time it is locked.

What you can keep

Logins (a name, an address, a username and a password), notes, and two-factor secrets: the vault can show the six-digit one-time code for a login (TOTP, the standard used by most authenticator apps), so one place holds both.

A copy for your phone

Off until you turn it on (the vault's Settings, Your phone). Then every save sends a copy to Moymo so that your phone can read it, and turning it off or deleting the vault removes the copy.

The copy has two locks: the file inside is still locked by your master password, and the copy around it is sealed for your account's own keys, which only your devices hold. Moymo keeps the copy but has neither lock, so it can read nothing and cannot even try passwords against it. The copy is signed by your account, so Moymo cannot hand your phone a vault of its own making, and the phone shows when the copy was made.

On the phone the vault is read-only: it opens in memory only, locks after a few minutes and when you leave the app, cannot be captured by screenshot, and a copied secret leaves the clipboard after 20 seconds. Five wrong passwords make you wait, longer each time.

Sharing one login with a friend

From an open entry, choose Share, then a friend. The login, password and two-factor secret included, is sealed for that friend's keys and signed by yours, the way a direct message is, but it never appears in anyone's chat history.

• It goes only to a friend whose keys you have checked (the safety number compared in your chat) and which have not changed since; otherwise the program refuses and says what to do.
• Only between mutual followers, and at most 20 can be waiting from you.
• What Moymo sees: who, to whom and when. Not even the entry's name.
• Your friend sees who sent it and what it is, never the password, and chooses Add to my vault or Turn down.
• It runs out after 7 days, and you can take it back until your friend takes it. Once taken it is theirs: it cannot be taken back from their vault.

Back it up

The vault is one file. If your disk fails you lose it, and with the master password forgotten it cannot be recovered. Keep a copy of the file somewhere safe, or use the phone copy as a second place.