When should I use a separate vault instead of a space?
Organising · Help center · Current as of 2026-10-10
Short answer
Use a space for almost everything: it costs nothing to create and nothing to change your mind about. Reach for a separate vault only when you want genuine cryptographic separation — its own passphrase, unlockable independently — and accept that it is a second passphrase nobody can recover for you.
Four levels, from hardest to softest
| Level | What it is | Use it for |
|---|---|---|
| Vault | A separate encrypted database with its own passphrase and sync account, cryptographically independent of your other vaults. | A genuine separation: personal versus a client's systems. |
| Space | A coloured top-level division inside one vault, with its own auto-lock and visibility policy. | Work, Personal, Servers. |
| Group | A folder inside a space. Groups nest. | AWS, then Production inside it. |
| Tags | Labels that ignore the hierarchy entirely. | The things a tree cannot express: #root, #legacy. |
Which one should you reach for?
Use a space first: it is free to create, costs nothing to change your mind about, and covers most of what people mean by "keep these apart". Reach for a separate vault only when you want cryptographic separation — a different passphrase, unlockable independently. That strength is also its cost: a second vault is a second passphrase to remember, and nobody can recover it for you.
Also available
Favourites for the handful you use daily, an archive for entries you cannot delete but never open, and a trash that holds deleted entries for 30 days. Organising 2FA at a few hundred accounts works through the whole model properly.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms