$ loading▍
$ loading▍
// docs/pumpkins-vault
An end-to-end encrypted vault for your secrets — setting it up, working with cards, and how the encryption works.
Your account password signs you in. Your secret key unlocks your data. Resetting your password gets you back into your account, but only the secret key can decrypt your cards.
Every time you open the vault it asks for your secret key, then derives your key, verifies it, and decrypts your cards — all in the browser. A wrong key is rejected with That secret key isn't right.
The unlocked key only lives in memory. Refreshing the page, closing the tab, or choosing Lock vault from the account menu locks it again.
A card is anything worth keeping: a login, a payment card, a Wi-Fi password, a note. Choose New card (or press N anywhere on the page) and start from a template or a blank card.
| Template | Fields it starts with |
|---|---|
| Login | Website, Username, Password |
| Payment card | Cardholder, Card number, Expiry, CVV |
| Wi-Fi | Network name, Password |
| Secure note | Note |
| Identity | Full name, ID number, Date of birth |
| Bank account | Bank, Account number, IBAN / Routing |
Templates are only a starting point — rename, add or remove fields freely. Each field has a type:
| Field type | Behaviour |
|---|---|
| Text | Plain value, shown as-is. |
| Secret | Masked until you choose Reveal. Not included in search. |
| Link | A URL. |
| Note | Multi-line text. |
| Item | Limit |
|---|---|
| Card title | 120 characters |
| Fields per card | 50 |
| Field label | 60 characters |
| Field value | 5,000 characters |
Pumpkins Vault uses envelope encryption, entirely through the browser's Web Crypto API. Nothing that can decrypt your cards ever reaches the server.
secret key ──PBKDF2-SHA256 (600,000 rounds)──▶ key-encryption key
random data key (AES-256-GCM) ──wrapped with the KEK──▶ stored on server
card JSON ──AES-256-GCM with the data key──▶ stored on server
| The server stores | The server never sees |
|---|---|
| Your account email | Your secret key |
| The salt and iteration count | The unwrapped data key |
| The wrapped data key | Card titles, icons, colors and pins |
| Each card's IV and ciphertext | Any field label or value |
| When each card was created and updated | — |
When creating the vault you can tick Also email me a copy of my key. Before it's turned on, you're shown exactly what that means:
If you asked for the email and it can't be sent, the vault isn't created — so you're never left relying on a backup that doesn't exist.
| You forgot… | What to do |
|---|---|
| Your account password | Use Forgot password on the sign-in page to get a reset link by email. Your vault is unaffected. |
| Your secret key | Use your recovery kit (or the key email, if you asked for one). |
There is no way to recover a lost secret key. It isn't stored anywhere, so without it your cards can't be decrypted — by you or by anyone else.
Tell me what you're building and where you're stuck. I typically reply within a day.