Auto-Lock —
keys purged from memory when you walk away

The inactivity timer resets on every user interaction — page navigation, item click, form field input, scroll. As long as you're actively using the vault, it stays open. After 15 consecutive minutes with no interaction, the lock triggers automatically. The timer runs in the browser independently of server-side sessions.

Decryption keys are stored in browser sessionStorage during an active vault session — they are never written to localStorage (which persists across browser restarts) or cookies. When the vault locks, sessionStorage is cleared. The keys no longer exist anywhere in the browser. Re-deriving them requires entering your master password again.

On lock, the browser notifies the server to mark the session as locked. All vault API routes check session lock status before returning data — even if someone somehow obtained a valid session cookie, they could not fetch vault data from a locked session without re-authenticating with the master password.

Re-entering your master password on the lock screen derives the encryption keys in the browser (~300ms). The server verifies your auth key and returns any updated vault data. Your vault reopens exactly where you left it — same folder, same view, same search context. Unlocking is designed to be fast despite the key derivation cost.

A "Lock Vault" button is always accessible in the sidebar. Click it before stepping away from your desk, before handing your laptop to someone, or any time you want immediate protection. Manual lock is instantaneous — keys cleared, session marked, lock screen shown in under 100ms.

When you close the browser tab or window, sessionStorage is automatically cleared by the browser — your decryption keys are gone. Opening the Vault URL again starts a new session and requires master password entry. There is no "remember me" for vault decryption.

Auto-lock is separate from your Pivlu account login session. You can remain logged in to your Pivlu account while the vault is locked. Unlocking the vault re-derives only the vault keys — it does not re-authenticate your account session, keeping the two security layers independent.