Vodou includes a built-in, encrypted password manager called the vault. Open it with the 💼 toolbar button or Ctrl+Shift+V. The first time, you'll be asked to create a master password — this becomes the encryption key for everything you save.

There is no password recovery. If you forget your master password, the saved logins cannot be decrypted — see "Forgot your master password?" below.

How it's protected

The vault file (~/.vodou/vault.dat) is encrypted with Fernet (AES-128-CBC + HMAC-SHA256) under a key derived from your master password using scrypt, a memory-hard, GPU-resistant key-derivation function. Nothing is ever written to disk unencrypted.

Everyday use

The vault window is an ordinary window, not a dialog that blocks the browser — it stays open alongside everything else, drops behind when you click away, and comes back via its taskbar entry. Add, edit, and delete entries from the left side; Go to site and copy actions are on the right. A Manage menu gathers the occasional vault-wide tasks, grouped into Security (a two-factor on/off switch, security keys, and changing your master password), Auto-lock, and Data (CSV import/export).

The login table's columns

Each saved login shows seven columns:

  • Website and Username/Email — what you saved.
  • Website Safety — the same local, no-network checks the address bar runs (look-alike/typosquat detection and the malicious-site list) applied to the saved site itself, so a login for a site that later turns out to be a look-alike doesn't just sit there unnoticed.
  • Password — masked by default; click the cell to reveal it, click again to hide it. Nothing is copied to the clipboard by this — use the Copy password button for that.
  • Strength and Duplicated — see Password strength, reuse, and generating strong passwords and Finding and removing duplicate logins.
  • Last Changed — the date you last added or edited that entry.

When you open the vault while on a site, any logins you've saved for that site are automatically floated to the top of the list — matching on the saved address, and treating www. and subdomains as the same site — so the login you're most likely to want is first. This only reorders the list; searching and the order of everything else are unchanged, and with no current site the list keeps its usual order.

Reading the vault button

The vault toolbar button shows its own state: a red safe with a closed padlock when locked, a green one with an open padlock when unlocked. It also pulses when a page has a login form but the vault is still locked, pointing you toward unlocking it.

Auto-lock

The vault automatically locks itself after a period of inactivity (this also closes the vault window if it was left open). By default that's 5 minutes, but you can change it under Vault window → Manage → Auto-lock vault to 5 minutes, 2 hours, 1 day, or 1 week. A longer window is more convenient but keeps the vault's key in memory that much longer, so the menu flags it — pick the shortest window you're comfortable with. You can also lock the vault immediately at any time with Ctrl+Shift+L or ☰ → Lock vault (log out).

Forgot your master password?

The unlock window has a Start over button. Because the password is the encryption key, there's no way to recover it — Start Over deletes the vault entirely so you can create a fresh, empty one. It requires you to type RESET to confirm, since it permanently erases every saved login. If that matters to you, keep an encrypted CSV export somewhere safe beforehand — see Importing and exporting passwords.