Vault
Defined in: vault.ts:158
One Vault per storage area: writes to the envelope are serialized inside the instance, so two
instances over the same area could still overwrite each other.
Constructors
Section titled “Constructors”Constructor
Section titled “Constructor”new Vault(
options):Vault
Defined in: vault.ts:168
Parameters
Section titled “Parameters”options
Section titled “options”Returns
Section titled “Returns”Vault
Methods
Section titled “Methods”addPasskey()
Section titled “addPasskey()”addPasskey(
dek,passkey):Promise<void>
Defined in: vault.ts:322
Register a passkey as a second unlock path: the DEK (from the unlocked session)
is sealed under HKDF-SHA256(prf, salt = credential id). The password stays
the recovery path; prf is zeroized here. A v1 envelope must be unlocked (and
thereby upgraded) first, and the vault must hold a secret (it proves the DEK).
Parameters
Section titled “Parameters”Uint8Array
passkey
Section titled “passkey”number
string
string
Uint8Array
publicKey?
Section titled “publicKey?”string
Returns
Section titled “Returns”Promise<void>
changePassword()
Section titled “changePassword()”changePassword(
oldPassword,newPassword):Promise<void>
Defined in: vault.ts:243
Re-wrap the DEK under a new password (fresh salt, current KDF). Secrets and passkeys are untouched — and so is the DEK: after a suspected compromise (a copied profile, a leaked session, a lost passkey) this is not enough, because whoever holds the DEK still opens every secret, old and new. Use Vault.rotateVaultKey then.
Parameters
Section titled “Parameters”oldPassword
Section titled “oldPassword”string
newPassword
Section titled “newPassword”string
Returns
Section titled “Returns”Promise<void>
create()
Section titled “create()”create(
password):Promise<Uint8Array<ArrayBufferLike>>
Defined in: vault.ts:199
Create an empty vault protected by password. Returns the DEK — hand it to the
session, then setSecret the first seed. Refuses when a vault exists.
Parameters
Section titled “Parameters”password
Section titled “password”string
Returns
Section titled “Returns”Promise<Uint8Array<ArrayBufferLike>>
deleteSecret()
Section titled “deleteSecret()”deleteSecret(
sourceId):Promise<void>
Defined in: vault.ts:406
Parameters
Section titled “Parameters”sourceId
Section titled “sourceId”string
Returns
Section titled “Returns”Promise<void>
destroy()
Section titled “destroy()”destroy():
Promise<void>
Defined in: vault.ts:418
Remove the whole vault. The explicit destructive flow only (back up → wipe → create).
Returns
Section titled “Returns”Promise<void>
exists()
Section titled “exists()”exists():
Promise<boolean>
Defined in: vault.ts:182
Returns
Section titled “Returns”Promise<boolean>
getSecret()
Section titled “getSecret()”getSecret(
dek,sourceId):Promise<Uint8Array<ArrayBufferLike> |null>
Defined in: vault.ts:397
Unseal one secret. null when the id is unknown; the caller zeroizes the result after use.
Parameters
Section titled “Parameters”Uint8Array
sourceId
Section titled “sourceId”string
Returns
Section titled “Returns”Promise<Uint8Array<ArrayBufferLike> | null>
kdfInfo()
Section titled “kdfInfo()”kdfInfo():
Promise<VaultKdfInfo|null>
Defined in: vault.ts:187
What protects the DEK right now (UI). null without a vault.
Returns
Section titled “Returns”Promise<VaultKdfInfo | null>
listPasskeys()
Section titled “listPasskeys()”listPasskeys():
Promise<object[]>
Defined in: vault.ts:302
Public view of the registered passkeys (ids, labels; whether each can verify assertions).
Returns
Section titled “Returns”Promise<object[]>
listSecretIds()
Section titled “listSecretIds()”listSecretIds():
Promise<string[]>
Defined in: vault.ts:372
Returns
Section titled “Returns”Promise<string[]>
passkeyPublicKey()
Section titled “passkeyPublicKey()”passkeyPublicKey(
id):Promise<{alg:number;publicKey:string; } |null>
Defined in: vault.ts:309
The SPKI public key (base64) of one passkey, for assertion verification; null when unknown.
Parameters
Section titled “Parameters”string
Returns
Section titled “Returns”Promise<{ alg: number; publicKey: string; } | null>
removePasskey()
Section titled “removePasskey()”removePasskey(
id):Promise<void>
Defined in: vault.ts:361
Forget one passkey’s box. A DEK that passkey already unwrapped stays valid: after a lost or compromised passkey, Vault.rotateVaultKey.
Parameters
Section titled “Parameters”string
Returns
Section titled “Returns”Promise<void>
rotateVaultKey()
Section titled “rotateVaultKey()”rotateVaultKey(
password):Promise<Uint8Array<ArrayBufferLike>>
Defined in: vault.ts:269
Replace the DEK (scan 2026-10-27 modules, F30): a fresh random DEK, every secret re-sealed under it,
the DEK wrapped under password with a fresh salt — written as one envelope, so a failure leaves the
old vault as it was. Returns the new DEK: hand it to session.unlock(dek), which overwrites the old
one in chrome.storage.session. A DEK copied before the rotation opens nothing in the new envelope,
and Vault.setSecret refuses it, so a stale session cannot seal new secrets under it.
Passkeys are dropped — their boxes hold the old DEK and cannot be re-wrapped without their PRF output — and must be registered again (Vault.addPasskey with the new DEK).
Parameters
Section titled “Parameters”password
Section titled “password”string
Returns
Section titled “Returns”Promise<Uint8Array<ArrayBufferLike>>
setSecret()
Section titled “setSecret()”setSecret(
dek,sourceId,secret):Promise<void>
Defined in: vault.ts:381
Seal secret under the DEK as sourceId (overwrites an entry with the same id). The DEK must open the
vault’s secrets (locked otherwise): a key retired by Vault.rotateVaultKey never seals a new one.
Parameters
Section titled “Parameters”Uint8Array
sourceId
Section titled “sourceId”string
secret
Section titled “secret”Uint8Array
Returns
Section titled “Returns”Promise<void>
unlock()
Section titled “unlock()”unlock(
password):Promise<Uint8Array<ArrayBufferLike>>
Defined in: vault.ts:214
Derive the KEK from password, unseal and return the DEK. wrong-password on
failure. A v1 (PBKDF2) envelope that opens is re-sealed as v2 (scrypt) on the
way out, secrets untouched.
Parameters
Section titled “Parameters”password
Section titled “password”string
Returns
Section titled “Returns”Promise<Uint8Array<ArrayBufferLike>>
unlockWithPasskey()
Section titled “unlockWithPasskey()”unlockWithPasskey(
id,prf):Promise<Uint8Array<ArrayBufferLike>>
Defined in: vault.ts:345
Unseal the DEK with a passkey’s PRF output. wrong-password when the box does not open, missing when the id is unknown.
Parameters
Section titled “Parameters”string
Uint8Array
Returns
Section titled “Returns”Promise<Uint8Array<ArrayBufferLike>>