Password Vault Beta

A built-in password manager. Logins, API keys, payment cards, secure notes, and captured browser sessions live in one encrypted store on your machine, behind a single master password. The browser's autofill talks to the same store, so credentials never have to leave it.

Beta

The vault is functional and your data is encrypted at rest, but it is still maturing and may have bugs. Keep an independent backup of any critical credential while it is in beta, and remember there is no master-password recovery (see below). What “Beta” means.

What can the vault store?

A vault record is one of:

Record and What it holds
Record	What it holds
Login	A host, username, and sealed password, with optional TOTP seed, recovery codes, and notes
API key	A labeled secret, handy for the keys you paste into the AI chat, scripts, or MCP integrations
Payment card	Number, name, expiry, CVV, and notes, sealed end to end
Secure note	Free-form text for anything else: recovery phrases, 2FA backup codes, a hidden Wi-Fi password
Browser session	A captured cookie set used to revive a logged-in session in another profile
Never save	A tombstone for sites you've told MetaDock not to offer to save credentials for

Logins, API keys, and secure notes are what you add and edit by hand. Browser sessions and “never save” entries are written by the browser on your behalf.

What happens if I forget the master password?

Setting up the vault asks for a master password. From then on, every record is encrypted with a key that only your master password can unlock.

•You set it once: MetaDock never sends it anywhere
•You can change it: changing rewraps the encryption key, so it's instant even with thousands of entries

Warning

There is no recovery.No reset email, no security questions. If you forget the master password, the vault's contents are gone for good. Pick something you can remember.

When does the vault lock itself?

The vault is either locked (no key in memory, nothing readable) or unlocked (key held in protected memory while you use it).

•Lock manually: from the vault dock or the lock command; the key is wiped from memory immediately
•Auto-lock on idle: the vault relocks after 15 minutes with no access; the timeout is fixed and there is no setting for it yet
•Lock on app close: closing MetaDock locks the vault, and the next launch starts locked

While locked, autofill goes silent and any attempt to read a record fails with a clear “vault is locked” message. The vault is shared across every MetaDock window, so unlocking in one unlocks all of them, and locking anywhere locks it everywhere.

How does autofill work in a browser panel?

When you sign into a site in a MetaDock browser, MetaDock notices the form submit, captures the username and password, and offers to save them, scoped to that profile. Next time you visit the same domain in the same profile, the matching usernames appear as suggestions and picking one fills the password too.

•Suggestions surface inline: click into a username field and the matching saved logins for that profile drop down
•You stay in control: nothing fills without you picking it, and there's no auto-submit
•Unlock required: if the vault is locked, MetaDock prompts you to unlock rather than failing silently
•Never save here: a one-click option on the save prompt so a site stops asking

Can I scope a login to one profile?

Vault records carry the same notion of profile as the rest of MetaDock. A login captured in the Acme Client profile is tagged for that profile and only autofills there; the same site under your Personal profile saves a separate record. Nothing crosses between profiles by default.

•A specific profile: the default for anything the browser captures
•Any profile: the default for records you add by hand, for keys and notes you want available everywhere

You can change a record's profile at any time in the vault dock.

How is the vault encrypted?

Your vault is encrypted on your machine and unlocked only by your master password. Nothing is stored in plain text, nothing is uploaded, and the master password is never sent anywhere. The encryption is additionally tied to your Windows login, so the vault only opens on your own signed-in machine.

•Nothing on disk is plaintext: host, username, label, passwords, card numbers, notes, and cookies are all sealed; the database holds only opaque rows
•Two locks, not one: an attacker with the database file still needs both your master password and the ability to log in as you on this Windows machine
•No cloud sync: the vault lives on your machine; there is no MetaDock-hosted vault server

How do I get logins in and out of the vault?

You do not have to retype anything. The vault reads the export formats other password managers and browsers produce:

Format and Comes from
Format	Comes from
CSV	Chrome, Edge, Firefox, Safari, LastPass, Dashlane, NordPass, and most other managers
Bitwarden JSON	A Bitwarden vault export
.1pux	A 1Password export

Entries are matched on site and username, so re-importing a fresh export does not create duplicates. If a password has changed since your last import, the existing entry is updated with the new one rather than skipped, and the summary tells you how many were added, updated, and skipped.

Going the other way, the Export menu writes your logins to a CSV or JSON file. Both require the vault to be unlocked.

Warning

An exported file is plain text. Anything you export is readable by anything that can open the file, so treat it as a temporary transfer artifact and delete it once you have imported it somewhere else.

Pulling logins straight out of another browser installed on this PC? The import wizard does that without an export file in between.

What else should I know about the vault?

Two things catch people out. Auto-lock can fire while you have an unsaved edit open and close the form, so save before walking away. And copying the database file to another PC does not work: the key is wrapped under your Windows login, so use a profile bundle or full backup instead.

•Search works on the unlocked vault: because everything on disk is sealed, listing and searching operate on the decrypted records held in memory while the vault is open
•Auto-lock can catch you mid-edit: if it fires while you have an unsaved edit open, the form closes, so save before walking away
•Moving machines: copying the database file does not work; the encryption key is also wrapped under your Windows login, so the copy will not unlock anywhere else. Use the portable profile bundle (.mdprof) export, or the full backup file, both of which re-wrap the key for the new machine. You still need the master password there