Vault

The Local Vault is an optional encrypted store for credentials that Zync uses on this device. You choose the passphrase and keep the recovery key. Zync does not host your vault or your credentials.

Local by default

You can use Zync without setting up a vault. SSH key files that remain on disk continue to work, and you can choose the authentication method that fits each connection.

What the Vault protects

The Vault encrypts stored passwords, private keys, and supported provider credentials at rest. It uses Argon2id key derivation and authenticated encryption (AEAD). Hosts refer to vault credentials by a stable identity, so changing or restoring a credential does not require recreating every host.

The Vault also supports:

• A recovery key for regaining access if you forget the vault passphrase.
• Optional Remember on this device, which stores unlock material in the operating system credential store.
• Credential revisions, so you can review and restore an earlier encrypted revision.
• Migration of supported credentials from older local connection records into the Vault.

Set up the Vault

Open Vaults in the Zync sidebar. On first use:

1. Create a strong vault passphrase.
2. Save the recovery key somewhere offline and safe.
3. Decide whether to enable Remember on this device.

Protect the recovery key

If you lose both the vault passphrase and the recovery key, the local vault cannot be decrypted. Zync cannot recover either secret for you.

Store a connection credential

When you add or edit a connection, choose Vault storage for a password or private key. The host record keeps a reference to the credential instead of embedding the raw secret.

Key files are still a first-class option. A key can remain at its existing path and be used by SSH without being copied into the Vault. If you later import a key into the Vault, the original file is not needed for the vault-backed connection.

AI provider API keys follow a stricter policy: they are encrypted in the Local Vault, remain on this device, and are excluded from credential sync and full vault backup exports.

Unlock and connect

Vault-backed connections ask you to unlock before connecting or testing. Opening a tab does not silently connect a vault-backed host. After unlocking, reconnect explicitly when you are ready.

Remember-on-device is convenient on a personal computer, but anyone who can use your unlocked operating-system session may be able to use vault-backed connections until the cache expires or you choose Forget device.

Only one Zync process can open a local vault at a time. If another window reports Vault In Use, switch to the existing Zync instance instead of creating another vault.

Vault and Sync & Backup

These are related but separate features:

Feature	Purpose
Local Vault	Optional, on-device encrypted credential storage.
Sync & Backup	Optional encrypted upload and restore using your Google Drive.
Public URLs	Separate beta sharing service for selected localhost ports.

Drive sync is not required to use the Local Vault. If you enable it, read Sync & Backup before uploading credentials or other workspace data.

Recovery and reset

If you know the current passphrase, use the Vault security controls to change it. If you forgot it but kept the recovery key, use the recovery flow to regain access and set a new passphrase.

If both unlock methods are lost, reset the local vault on this device and create a new one. Resetting removes the local encrypted vault and clears local host references to its credentials. It does not delete encrypted records stored in your Google Drive, but those records still require their sync passphrase and a working local vault to use.

Troubleshooting a missing credential

Open the host’s authentication settings and review its linked Vault credential. Zync can repair stale stored record locations when the stable credential identity still exists. If the credential was deleted, choose another credential or create a replacement rather than recreating the entire host.

Related docs

• Sync & Backup for optional Google Drive storage and restore behavior.
• Security for data boundaries, recovery guidance, and Public URLs exposure.