# The private vault

Some files deserve a second lock: tax returns, medical records, scans of your ID. This page explains what the vault is, how to put files in it, and the one rule you must not skip — saving your recovery key.

## What the vault is (and isn't)

The vault is a locked box inside SearchBox. Files you put in it are **copied in and encrypted on disk** — scrambled with a key that comes from your password, using AES-256 (the same grade of encryption banks use). Even if someone copied the files off your hard drive, they'd get unreadable gibberish without your password.

That's different from your [indexed folders](./folders-and-archives.md), where files stay wherever they already live and only SearchBox's notes about them are stored.

You can still *search* vault files like everything else — SearchBox decrypts them only for you, only on your machine.

> 🔒 Nothing about the vault ever leaves your computer: not the files, not the keys, not your password.

## Putting files in the vault

1. Click the **upload button** (the arrow icon, top-right of the home screen).
2. Stay on the **Vault** tab.
3. Drag files onto the drop zone, or click **browse** and pick them.

![The Vault tab of the upload window](img/vault-upload.png)
<!-- SCREENSHOT NEEDED: The "Manage Documents" modal on the Vault tab showing the dashed drag-and-drop zone with the "Files are encrypted and stored securely" note. Bonus: capture mid-upload or right after, with an uploaded file visible. -->

Each file is encrypted the moment it's stored, then indexed so it shows up in search.

## Finding and opening vault files

Vault results appear in normal searches with a small **lock badge** next to the title. To see *only* vault files, search:

```
::vault
```

![Search results filtered to the vault](img/vault-results.png)
<!-- SCREENSHOT NEEDED: Results for the query "::vault" showing 2-3 vault documents, each with the blue lock badge next to its title, and the "Vault" source label on the result rows. -->

Opening a vault file may ask you to unlock the vault first (see below). Once unlocked, it opens in the viewer like any other document.

## Locked after a restart — that's on purpose

Whenever SearchBox restarts, the vault **locks itself again**. The key that decrypts your files is held only in the app's memory and is deliberately thrown away when the app closes — so a copy of your data folder, or a stolen laptop that's been powered off, never exposes the vault.

To unlock it again:

1. Open **Settings** (the gear icon).
2. In **Vault Security** you'll see a **Vault locked** notice.
3. Type your password and click **Unlock**.

![The Vault locked notice in Settings](img/vault-unlock.png)
<!-- SCREENSHOT NEEDED: Settings → Vault Security showing the "Vault locked" panel with the password field and Unlock button (restart SearchBox first to make it appear). -->

The vault stays unlocked until the next restart.

## Your recovery key — the spare key to everything

Your password is what your vault's encryption is built on. If you forget it, the **recovery key** you saved during setup is the *only* way to reset your password and keep your vault. There is no "email me a reset link" — that's the price (and the point) of nothing living on anyone else's server.

- Forgot your password? On the login screen, click **Forgot password?**, paste your recovery key, and choose a new password.
- Not sure where your key is? While you can still log in, make a fresh one: **Settings → Account → Generate Recovery Key** — then save it somewhere safe this time. The new key replaces the old one.

> ⚠️ No password *and* no recovery key means the vault's contents are gone for good. Encryption doesn't have a back door — that's what makes it trustworthy.

## Emptying the vault

**Settings → Vault Security → Reset Vault** permanently deletes every file in the vault and clears its keys. You'll be asked to type `RESET` to confirm, because there is no undo. Your indexed folders are not touched.

## Want the deep technical details?

The exact encryption design — key derivation, what's stored where, and the threat model — is written up in [SECURITY.md](../../SECURITY.md).

## Try it

The [Set up a private vault](./tutorials/private-vault.md) tutorial walks through all of this with a real file, start to finish.

---
[← Back to the manual](./README.md)