Password Vault Overview
The 4-digit PIN of Password Vault opens your vault: without it, the web part shows no entries, and the key that decrypts them is derived from it. You set it when you first open the web part (see KB10442. How to Set Up Your PIN in Password Vault), and you can change it at any time — for example, if someone may have seen you type it. Changing the PIN requires knowing the current one.
Before you start
- You need your current PIN. If you have forgotten it, the PIN cannot be changed — see If you have forgotten your PIN below.
- Other open copies of the vault do not need to be closed. If Password Vault is open in another browser tab, on another device or in Microsoft Teams, that page locks itself after the change and asks for the new PIN (see Other open pages).
- Choose a new PIN you will remember. A new PIN is typed only once; there is no confirmation field.
Changing the PIN
- Open any page or Teams tab with the Password Vault web part and unlock the vault: type your current PIN in the Enter PIN prompt that is shown instead of the list (Enter your PIN to proceed). It is checked automatically after the fourth digit. If the vault is already unlocked, skip this step.
- Click the gear icon button Configure at the top right of the web part and select Change PIN. The gear is shown only while the vault is unlocked.
- The Change PIN screen replaces the list. Type the new 4-digit PIN in the four boxes. The digits are visible as you type — check them before you continue, and make sure nobody is watching your screen.
- Click Change PIN. The button becomes available once all four digits are entered. To keep the current PIN, click Cancel instead.
- The list of entries returns with the message The PIN has been changed. From now on, use the new PIN on every page, device and Teams tab.
The vault stays unlocked after the change, so you can continue working without entering the new PIN right away. The next time the vault locks, it asks for the new PIN.
❗ Important
Clicks and key presses on the Change PIN screen count as activity, so the vault does not lock while you type the new PIN. Only if the screen is left untouched for five minutes does the automatic lock close it: the PIN prompt is shown instead of the list and the PIN stays unchanged. Simply unlock the vault and start again from the Configure menu. The automatic lock is described in KB10451. Automatic Lock: When Password Vault Asks for the PIN Again.
What happens to your entries
The encryption key of your entries is derived from your PIN with PBKDF2-SHA256 (a random salt, 600,000 iterations) in your browser and is not stored anywhere. When you click Change PIN, the web part therefore derives a new key from the new PIN with a new random salt, decrypts every entry with the old key and encrypts it again with the new one, in your browser, and saves the vault file to your OneDrive in one operation. Name, user name, password, URL, notes, folder and tags of all entries are re-encrypted; favorites are kept.
- Your entries do not change: nothing is added, removed or altered.
- The modification dates stored with the entries are kept, so a PIN change does not make all entries look recently edited.
- The failed-attempt counter is reset to zero.
If the save fails, the error bar Sorry, something went wrong. Please refresh the page and try again. appears on the Change PIN screen and the old PIN remains valid. Refresh the page and repeat the steps.
📝 Note
The PIN controls access inside the web part and is used to derive the encryption key, but it is not the only protection of your data: the vault file lives in your own OneDrive and is protected by Microsoft 365 access control. Details are in KB10452. How Password Vault Protects Your Data: Encryption, PIN and Storage.
Other open pages
A page that was already open before the change notices the new PIN the next time it reads or writes the vault file — when you click Refresh, save a change or unlock the vault there. It then locks itself and asks for the new PIN; the old PIN no longer works on it. A change made on such a page is not saved, so an outdated page can no longer undo the PIN change. To bring the other pages up to date at once:
- click Refresh (the icon button at the top right of the web part) or reload every other page, tab or Teams app where your vault is open; or
- close those pages and open them again.
After that, they ask for the new PIN.
If you have forgotten your PIN
Change PIN works only with the current PIN, and the PIN cannot be recovered or reset by you, your administrator or Vitextra. If you have forgotten it, read KB10460. I Forgot My PIN in Password Vault: What Are My Options? before you try PINs at random: after five incorrect PINs in a row, the vault offers only a reset that deletes all entries — see KB10461. Why Password Vault Is Blocked: "You've Entered an Incorrect PIN Too Many Times".
💡 Tip
Choose a PIN that is not your phone unlock code, your bank card PIN or an obvious sequence such as 1234 or 0000, and keep a note of it in a safe place in line with your organisation's policy. Keep the most important credentials also in another approved place, so that a forgotten PIN does not mean losing access to them.
