How Password Vault Protects Your Data: Encryption, PIN and Storage

Overview

Password Vault is a personal password manager for SharePoint Online pages and Microsoft Teams. Each user keeps his or her own credentials in a single encrypted file in his or her own OneDrive. This article explains, layer by layer, how the data is protected, what the PIN does and does not do, which parts of the vault are encrypted, and what kind of credentials Password Vault is designed for. It is intended for end users who want to understand the product and for administrators and security officers who review it.

Summary

Layer 1: Microsoft 365 sign-in and OneDrive access control

Password Vault has no accounts, servers or databases of its own. The web part runs in the browser of the signed-in user and reads and writes the vault through Microsoft Graph with that user's identity. The file is stored in the user's own OneDrive, so it is protected by the same mechanisms as any other file there: Microsoft 365 sign-in (including multifactor authentication and Conditional Access, if your organization uses them), OneDrive permissions and your organization's Microsoft 365 policies.

The web part uses a single delegated permission, Files.ReadWrite.AppFolder, which lets it work only in the app folder of the signed-in user's OneDrive. It cannot open other files of the user and cannot open another user's OneDrive. For details, see KB10454. Microsoft Graph Permission Files.ReadWrite.AppFolder: Why Password Vault Needs It and How to Approve It.

Because the vault is kept in the user's OneDrive and not on the page, every user who opens a page or Teams tab with the web part sees only his or her own vault. Placing the web part on a shared page does not share any passwords.

Layer 2: Encryption of the entries in the browser

Before the vault is saved, Password Vault encrypts the text fields of every entry with AES. Encryption and decryption take place in the user's browser; the file travels only between the browser and the user's OneDrive through Microsoft Graph. As a result, the values are never stored or transferred as plain text: a person who opens the file sees encrypted strings instead of names, user names and passwords.

The encryption key is derived from the PIN in the browser with PBKDF2-SHA256 (Web Crypto), using a random 16-byte salt and 600,000 iterations; a new salt is created whenever a PIN is set or changed. The key is not stored anywhere — not in the vault file, not in the browser storage and not at Vitextra. It exists only in the memory of the open page while the vault is unlocked. To verify a PIN, the web part derives the key from it and decrypts a check value — a known text encrypted with the key — that the file stores together with the salt and the iteration count. Neither the PIN nor a hash of the PIN is stored. As a result, the vault file alone is not enough to read the entries: the PIN is needed.

What is and is not encrypted

Nothing is written to SharePoint lists, to the web part properties or to the browser storage. The key and the decrypted values exist only in the memory of the open page while the vault is unlocked.

Existing vaults are upgraded automatically

Vaults created with earlier versions of Password Vault use the previous file format, in which the key was derived from a SHA-256 hash of the PIN stored in the file and the user's Microsoft Entra ID object ID. The first time you enter the correct PIN in the new version, the web part re-encrypts all entries with a new key derived with PBKDF2 and saves the vault in the new format. The entries and their modification dates are kept, and the failed-attempt counter is reset. You do not need to do anything. After the upgrade, the file no longer contains the PIN hash.

Layer 3: The PIN and the locked vault

The PIN is a 4-digit code that the user sets when the vault is created (see KB10442. How to Set Up Your PIN in Password Vault). It is needed once, to open the vault: the web part checks it as soon as the fourth digit is typed. Until then the vault is locked, and the web part shows no entries at all — not even their names. Instead of the list, it shows the Enter PIN prompt with "Enter your PIN to proceed" and four digit boxes, and the toolbar offers only the Refresh button.

After the correct PIN, the vault is unlocked and all these actions work directly, without asking for the PIN again, until the vault locks.

On the Enter PIN prompt, the digits are masked while you type them. On the Set up PIN and Change PIN screens they are visible, so set or change your PIN where nobody can watch your screen.

Automatic lock

After the page loads, the vault is locked: no entries are shown, only the Enter PIN prompt. After a correct PIN the vault opens and stays unlocked while you work. When there has been no click or key press inside the web part for 5 minutes (activity on the Change PIN screen counts too), the vault locks again: the list disappears, shown passwords are hidden, the key is removed from memory, and every open dialog (New Item, Edit Properties, the removal confirmation) is closed without saving. Reloading the page also locks the vault, because the unlocked state exists only in the open page. See KB10451. Automatic Lock: When Password Vault Asks for the PIN Again.

Failed-attempt limit

Each wrong PIN shows "The PIN is incorrect" and the number of Attempts left. The counter is stored in the vault file and is always increased from the latest version of the file, so attempts made on different devices and pages add up reliably. The Attempts left line is shown on the Enter PIN prompt whenever earlier wrong attempts exist, also after a reload or on another device. The counter does not reset with time — only a correct PIN resets it. After 5 wrong PINs in a row the vault is blocked: the web part shows only the Reset screen, and resetting erases all entries and the PIN. See KB10455. Incorrect PIN Attempts in Password Vault: What Happens After Five Failed Tries.

No data at Vitextra

Vitextra does not receive, store or back up vault data. The only requests from the web part to Vitextra services are the license check and usage telemetry with technical identifiers. For the full list, see KB10363. Where Vitextra Products Store Your Data: Privacy, Data Residency and GDPR.

What Password Vault is designed for

Password Vault is designed as a convenient, personal place for everyday credentials — sign-ins to web portals, partner systems, test accounts and similar entries that a user would otherwise keep in a notebook or a text file. Its protection combines Microsoft 365 access control with encryption of the stored values under a key derived from a 4-digit PIN.

It is not a privileged access management system: it has no sharing between users, no administrator recovery, no audit log of its own and no master password of high strength. For administrator accounts, service accounts, shared team credentials and other highly privileged secrets, follow your organization's policy and use the tools it prescribes. For a comparison with other approaches, see KB10440. Password Vault vs. Browser Password Managers and Enterprise Password Managers: Which to Choose.

Recommendations

• Protect your Microsoft 365 account: the vault is only as safe as the account that owns the OneDrive.
• Choose a PIN that is not easy to guess (avoid 0000, 1234 or your birth year) and keep it in a safe place.
• Do not share or copy the vault file: someone with a copy could try all 10,000 PINs offline.
• Lock your computer when you leave it, even for a short time.
• A copied password stays on the clipboard until you copy something else; clear the clipboard after use on shared computers.
• If you use the vault on several devices or tabs, changes are combined automatically; press Refresh to see changes made elsewhere (see KB10453. Where Password Vault Stores Your Passwords: The OneDrive App Folder).
• Store only credentials that your organization allows you to keep in a personal password manager.