How do I create my first vault?
Getting started · Help center · Current as of 2026-10-10
Short answer
Open the web app, give the vault a name, and choose a passphrase of at least 12 characters. That is the whole setup: no email address, no verification step, nothing uploaded. The passphrase encrypts the vault on this device and it is the one thing nobody can recover for you, so record it before you add anything that matters.
What the passphrase is actually doing
It is not a login. KeyNesta generates a random key for the vault, wraps that key with a second key stretched from your passphrase, and seals the vault with AES-256-GCM. What is stored is the wrapped key and the ciphertext; the passphrase itself is never written down anywhere by the app and never sent. The encryption architecture sets out the parameters.
If you already know you want it on two devices
Create the sync account first. Sign in, and the passphrase step follows, so the vault starts out synced instead of being switched over later. Either order works — sync can be turned on at any time from Settings — but doing it first saves a step.
More than one vault on the same device
Add another from the lock screen. Each vault has its own passphrase, its own encryption key and its own sync account, and switching to one locks the one you left. Decide whether you want a vault or a space before you create the second one: a space is almost always the right answer.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms