How do I lock the vault when I step away?
Security · Help center · Current as of 2026-10-10
Short answer
Lock it by hand from the lock button in the sidebar, which takes the key out of memory immediately. Auto-lock handles the times you forget: it is set to five minutes by default and can be 1, 5, 15 or never. A browser tab left hidden for at least that long comes back locked, and leaving a phone app locks it on the spot.
Everything in Settings, under Security
- Auto-lock — never, 1, 5 or 15 minutes of inactivity. Five is the default.
- Clipboard — clear a copied code after 10, 15, 30 or 60 seconds, or never. Thirty seconds is the default, and it exists because a 2FA code sitting in a shared clipboard is the easiest thing in this list to leak.
- Codes — always visible, or tap to reveal. Tap to reveal is the one that stops a screen share or a shoulder giving away a code you were not using.
A space can override the last two for itself, so a space holding a client's production systems can require a tap while your own logins stay visible.
What locking actually does
It discards the key from memory. The vault on disk is ciphertext either way, so locking is about the window in which an unlocked screen or a running process could reach the codes. It is also why sync stops when the vault locks: there is nothing to encrypt with.
On a machine that is not yours
Use a private window, lock when you step away rather than relying on the timer, and set auto-lock short. Switching to another vault locks the one you leave, which is worth knowing if you keep work and personal vaults separate. On the phone apps, Face ID or Touch ID makes a one-minute auto-lock bearable rather than infuriating.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms