Password Vault: passwords and private information

Password Vault stores passwords and other private information. Everything in it is encrypted in your browser before it reaches Magpie. Magpie stores the encrypted result and cannot read your Password Vault, including from the database.

Setting up Password Vault

The first time you open Password Vault, you choose a Password Vault password. This is separate from your Magpie account password. Magpie cannot recover it, and it does not need to match the password you sign in with. Changing your account password later does not affect Password Vault.

You are then shown a one-time recovery key. It is the only other way into your Password Vault if you forget your Password Vault password, and Magpie does not keep a copy. Save or download it before continuing; there is a confirmation step so this cannot be skipped by accident.

Unlocking and locking

Enter your Password Vault password to unlock it for the browser tab. The tab stays unlocked when you reload the page or visit another part of Magpie and come back, so you are not asked for the password again each time.

Password Vault locks again after 15 minutes without activity unless you change it. To change it, choose another time in The vault locks after … without activity at the top of the Password Vault list. Time spent in other parts of Magpie counts as inactivity. The setting applies in every browser where you use Password Vault on the website.

It also locks immediately when you click Lock or press Ctrl+L, and when you sign out of Magpie. Locking clears the unlocked keys; it does not delete anything. A new browser tab starts locked.

To stay unlocked across a reload, the tab keeps an encrypted copy of its key. Magpie holds the key to that copy only until the vault locks, and never has both at once, so Magpie still cannot open your vault.

If you forget your Password Vault password, use Forgot your vault password? Use your recovery key on the locked screen. Entering the recovery key lets you set a new Password Vault password without losing any saved items. If you lose both your Password Vault password and your recovery key, Magpie cannot recover your Password Vault.

The native app supports setup, recovery, unlock, all six item types, custom fields, tags, favorites, password generation, Trash, restore and permanent deletion. It keeps unwrapped keys in app memory after you leave Password Vault or switch apps. You can return without entering the vault password again while the app process remains open. Lock vault clears the keys. Signing out or closing the app process also requires another unlock. Concealed multi-line fields, such as recovery codes, stay hidden until you choose Show secret fields. The app can also import passwords from a CSV file and export the encrypted backup, as described below.

The website and native app open the same personal Password Vault for your Magpie account. Use the same Password Vault password on both. Encrypted items sync through Magpie; the Password Vault password does not. Team Password Vaults are not available yet, so changing the selected team does not change which vault opens.

Secure Files uses the same User Vault Key to encrypt file keys. An active same-tab Password Vault session also unlocks Secure Files. In the Magpie app, unlocking either Password Vault or Secure Files unlocks both, and locking either locks both.

Items

Password Vault currently supports six item types: logins, secure notes, API credentials, SSH keys, recovery codes, and custom items with your own fields. Each custom field can be marked concealed, which hides it behind Reveal the same way a password is hidden. Items can be tagged, marked as favorites, and searched. Search runs against the items already decrypted in your browser, so nothing you type is sent to Magpie.

In the mobile app, tap a saved password's dotted row to copy it. Choose Show beside the row to display the password without copying it. Choose Edit password to change the saved value. The copied password remains on the device clipboard until the clipboard is replaced or cleared by the device.

Git repository access tokens can be sent from the token page to Password Vault in another browser tab. Unlock Password Vault, review the pre-filled API credential, and save it.

The list shows one row per item: its name, username, website, tags, type and when it last changed. Every row is one line. A name, username or website too long for its column ends in …; choose it to show the whole value. At the end of each row, Copy opens a menu of that item's values to copy without opening it: Copy username and Copy password for a login, Copy API key for an API credential, Copy public key and Copy passphrase for an SSH key, and the first concealed field of a custom item. On a narrower window the Type column, then the Updated column, then the Tags column, then the Website column are left out. All items, Favorites and Trash switch between views. Search and the type filter narrow the current view. The list starts with the most recently updated item first; the sort menu can order it by name or by website instead. Click anywhere on a row to open the item; the website link opens the site in a new tab. Going back from an item returns to the same place in the list.

On an item's page, click a value such as the username, password or website to copy it. A concealed value is copied without being shown. The value briefly flashes green once it is on your clipboard. Choose Edit beside a value to change it, then press Enter or click elsewhere to save, or press Escape to cancel. A value that is empty shows Add and opens for typing when you click it. A concealed value stays hidden while you change it unless you choose Reveal first.

Click the title, notes or tags to change them. Notes save with Ctrl+Enter (Cmd+Enter on a Mac) or by clicking elsewhere. Each change is encrypted in your browser and saved straight away. For a custom item, Add, rename or remove fields opens a form for changing which fields it has. Items in Trash cannot be changed until they are restored.

Move to Trash is in More, beside the item's title. For an item in Trash, More has Delete forever, and Restore is beside the title.

SSH keys

An SSH key item stores a private key, its public key and the key's passphrase. Choose New item, then SSH key, and paste the contents of the private key file, such as ~/.ssh/id_ed25519. When the key is in OpenSSH format, the format ssh-keygen writes, the public key is filled in from it. For a key in another format, paste the public key from its .pub file as well. A public key you entered yourself is not replaced.

Generate key makes a new Ed25519 key in your browser. Its comment is the item's title. It has no passphrase; Password Vault encrypts it like every other value. To use the key, save the private key to a file that only you can read, such as ~/.ssh/id_ed25519 with chmod 600, and add the public key to the server or Git host. To add a passphrase, run ssh-keygen -p -f with the file, then paste the key back into the item.

The item shows the key type, such as Ed25519 or RSA, and its SHA256 fingerprint, which matches what ssh-keygen -l prints. Click the fingerprint to copy it. When the private key is protected by a passphrase, the key type says so. When the public key belongs to a different key than the private key, the item says that they do not match, and the fingerprint is the public key's.

The Magpie app stores SSH keys, fills in the public key and shows the type and fingerprint. It cannot generate a key.

Two-factor codes

A Login can also give you the code a website asks for after your password (often called a 2FA, OTP or authenticator code). Open the Login and choose Set up two-factor code. Choose Scan QR code and point your camera at the QR code the website shows when you turn on two-factor authentication, or paste the setup key printed under it. An otpauth:// link works too. A QR code or link carries the issuer, account, digits, seconds per code and algorithm; to set them yourself, open Labels and code settings. Supported algorithms are SHA1, SHA256 and SHA512. Counter-based HOTP and Steam codes are not supported.

The Login shows the current code and seconds remaining. Copy current code copies the digits without spaces and generates the code again at copy time. On the website, a progress bar also shows the time remaining. Codes depend on your device clock; use automatic date and time if a website rejects them.

Reveal setup details shows the setup key and its settings. Change two-factor code replaces them; Remove two-factor code removes the stored key. Removing it from Magpie does not turn off two-factor authentication on the website. In the native app, choose Use these setup details, then Save encrypted item to save the change. QR scanning uses the device camera. On the website, Scan QR code appears only in browsers that can read QR codes; elsewhere, paste the setup key.

The setup key and its labels are encrypted with the Login. Codes are generated in your browser or app, and neither the setup key nor a generated code is sent to Magpie. Saving the password and setup key together reduces the independence of the second factor: someone who can open this vault can use both. It still protects against someone obtaining the password alone. A phished current code can still be used before it expires.

Tags

Tags work as folders. Give an item one or more tags in its Tags field, separated by commas. An item with several tags is in each of those folders. When any item has a tag, a Tags row under the search bar lists every tag with the number of items it holds in the current view. Choose a tag to show only its items, Untagged for items without one, or All to show every item again. Each item's tags are also shown in the list's Tags column: the first two, then a count of the rest. Search matches tags too. "Work" and "work" count as the same tag.

To tag many items at once, select them and choose Add tag. Type a new tag and choose Add, or pick an existing tag. Remove tag lists the tags the selected items have. Each item is encrypted and saved again, one at a time. Tags are encrypted with the rest of the item, so Magpie cannot see them.

Deleting an item moves it to Trash rather than removing it immediately. Restore it from the Trash view, or delete it permanently from there.

To act on several items at once, check their boxes, or use the box in the column heading to check every item shown. A bar above the list names how many are selected and offers Move to Trash, or Restore and Delete forever in Trash. Only items shown in the list can be selected; changing the search or filter removes any selected item it hides. Outside Trash the bar also offers Add tag and Remove tag.

Password generator

On a login's page, Edit beside the password opens New password. Generate password there opens a generator with adjustable length and character options, and Use this password puts the suggestion in the field. Nothing changes until you choose Save password; Cancel closes it. The saved password moves to Password history. Change the password on the website too, or the new one will not work there. When you create an item, Generate password under the password field fills it in the same way. The generator uses your browser's secure random number generator, not an ordinary random function.

In the mobile app, choose Generate password under a login's password. Set the length, choose the character types, and choose Use this password. The password is generated on the device with its secure random number generator. It fills the field only; choose Save encrypted item to keep it.

Password history

When you change or remove a password, or another concealed value such as an API secret, a private key or recovery codes, the earlier value is kept in the Password history band under the item. It shows which value it was and the date it was replaced. Click an earlier value to copy it, or choose Reveal to see it.

Each earlier value is kept for at least 30 days after it is replaced. After that, only the 10 most recent values of each field are kept, and older ones are removed the next time the item is saved. History is encrypted with the rest of the item. Clear history removes every earlier value of the item; this cannot be undone. Deleting an item forever deletes its history too.

Password history is stored inside the item. To go back to an earlier version of the whole item, use Version history.

The Magpie app keeps history in the same way when you save a change there. It shows Password history on the item; values are hidden until you choose Show secret fields, and tapping one copies it. Clear history in the app takes effect when you choose Save encrypted item.

Importing

Import passwords, under More in the bar at the top of the Password Vault list, reads a CSV export from another password manager (Generic CSV, Google/Chrome Password Manager, Bitwarden, or 1Password) entirely in your browser. The file is never uploaded to Magpie. You review the parsed items before anything is saved; rows that look like something already in your Password Vault (same domain and username, or the same title) are flagged and unchecked by default, and you can select or deselect any row before importing.

In the mobile app, unlock the vault and choose Import passwords from its action menu. Choose the password manager the file came from, then the CSV file. The app reads it on your device, removes its own copy straight away, and shows the same review list. If the file has more items than the app imports at a time, the app says how many it can take; split the file and import each part. Delete the original CSV file when you are finished, because it holds your passwords in plain text.

CSV imports preserve TOTP data from Bitwarden's login_totp, 1Password's otpAuth, totp or one-time password, and generic totp, otpauth or otp columns. An invalid or unsupported secret stops file review so it is not silently omitted. Only CSV exports are supported; JSON and .1pux files are not imported.

Exporting

Export encrypted backup, under More in the bar at the top of the Password Vault list, downloads an encrypted backup (.magpievault). It contains the same ciphertext Magpie stores, plus what your Password Vault password or recovery key needs to decrypt it. It is not a plaintext file.

In the mobile app, unlock the vault and choose Export encrypted backup from its action menu, then save or send the file from the share sheet. It is the same file the website downloads, and it does not include items in Trash.

Version history

Each time an item is saved, on the website, in the app or in the browser extension, Magpie keeps a copy of the version it replaces. The Version history band under the item lists the earlier versions, newest first, with when each was saved and what changed after it, such as "Changed after this version: password and website".

Choose View to see an earlier version's values. Concealed values stay hidden until you choose Reveal, and clicking a value copies it. Choose Restore to put the item back to that version. The version you replace is kept in the list too, so you can restore it again. Password history is kept when you restore: the item's current password is added to it.

Each earlier version is kept for at least 30 days. After 30 days, the 10 most recent versions of each item are kept and older ones are removed the next time the item is saved. Earlier versions are encrypted like the item; Magpie cannot read them. Deleting an item forever deletes its earlier versions too.

Password history and Version history keep different things. Password history keeps earlier passwords and other concealed values inside the item itself. Version history keeps whole earlier copies of the item outside it, so it can put back an item that was changed by mistake or replaced with data that cannot be read.

Version history is on the website. The app and the browser extension save versions but do not show them.

An item that cannot be decrypted

If an item's saved data cannot be opened with your Password Vault key, the Password Vault list says how many items could not be decrypted and links to each. Open one and restore an earlier version from its Version history. If no earlier version can be opened, Delete forever on the same page removes the item.

What Magpie can and cannot see

Magpie can see that a Password Vault item exists, its size, and when it changed. Magpie cannot see an item's title, type, or any field inside it: all of that is encrypted before it leaves your browser. For a problem with Password Vault, Contact support.