When should I use tags instead of groups?
Organising · Help center · Current as of 2026-10-10
Short answer
Use a group when a code has one obvious home, and a tag when the thing you want to express cuts across the tree. An entry sits in exactly one group but can carry as many tags as you like, so #root, #legacy or #client-handover work where a folder would force you to choose. Tags are typed as a comma-separated list on the entry itself and are searched alongside everything else.
The test
If you can finish the sentence "this code lives in…", use a group. If what you want to say is "this code is also…", use a tag. Production credentials for six different providers live in six different groups and share one tag, and that is the case tags exist for.
How to add them
Open an entry and type into the tags field, separated by commas — production, critical. There is no separate tag manager to maintain and no limit to keep in mind. Search covers tags along with the entry name, issuer, account name and group path, so root aws finds a tagged entry without you remembering where you filed it.
Tags arrive with your imports
An Aegis export carries its groups across as KeyNesta tags rather than guessing at a hierarchy for you, and a CSV can carry a tags column. That makes tags the usual starting point after a migration: whatever structure the old app had becomes labels you can search, and you build the tree you actually want at your own pace. What imports from where has the detail.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms