--- title: "How Password Vault Protects Your Data: Encryption, PIN and Storage" description: "How the Vitextra Password Vault web part for SharePoint Online and Microsoft Teams protects personal credentials: Microsoft 365 sign-in and OneDrive access control, AES encryption of entry fields in the browser with a key derived from the PIN (PBKDF2), the locked vault, automatic lock, the five-attempt limit, what is and is not encrypted, the limits of a 4-digit PIN, and what Password Vault is designed for." url: https://vitextra.com/en/support/kb/10452 language: en published: 2026-11-03 modified: 2026-11-03 products: - "Password Vault" author: "Līga Ozola" tags: ["Password Vault security", "Password Vault encryption", "SharePoint password manager security", "AES encryption web part", "PBKDF2 PIN key", "Password Vault PIN", "OneDrive app folder encryption", "Password Vault automatic lock", "failed PIN attempts", "personal credentials SharePoint", "Vitextra Password Vault"] --- # How Password Vault Protects Your Data: Encryption, PIN and Storage How the Vitextra Password Vault web part for SharePoint Online and Microsoft Teams protects personal credentials: Microsoft 365 sign-in and OneDrive access control, AES encryption of entry fields in the browser with a key derived from the PIN (PBKDF2), the locked vault, automatic lock, the five-attempt limit, what is and is not encrypted, the limits of a 4-digit PIN, and what Password Vault is designed for. ## Overview [Password Vault](https://vitextra.com/en/products/password-vault) is a personal password manager for SharePoint Online pages and Microsoft Teams. Each user keeps his or her own credentials in a single encrypted file in his or her own OneDrive. This article explains, layer by layer, how the data is protected, what the PIN does and does not do, which parts of the vault are encrypted, and what kind of credentials Password Vault is designed for. It is intended for end users who want to understand the product and for administrators and security officers who review it. ## Summary | Question | Answer | |---|---| | Where is the vault stored? | In one file, *vitextra-password-vault.json*, in the app folder of the user's own OneDrive | | Who can open the file? | Whoever has access to the user's OneDrive under Microsoft 365 permissions — by default only the user | | Which identity is used? | The signed-in Microsoft 365 user, through Microsoft Graph with the delegated permission *Files.ReadWrite.AppFolder* | | What is encrypted? | The text fields of every entry: name, user name, password, URL, notes, folder and tags (AES, in the browser, with a key derived from the PIN) | | What does the PIN do? | The encryption key is derived from the 4-digit PIN; until the PIN is entered, the web part shows no entries at all | | When is the PIN asked again? | After 5 minutes without interaction in the web part, and after the page is reloaded | | What happens after wrong PINs? | After 5 wrong PINs in a row the vault is blocked and can only be reset, which erases all entries | | What is sent to Vitextra? | No vault data; only the technical identifiers of the license check and usage telemetry | ## Layer 1: Microsoft 365 sign-in and OneDrive access control Password Vault has no accounts, servers or databases of its own. The web part runs in the browser of the signed-in user and reads and writes the vault through Microsoft Graph with that user's identity. The file is stored in the user's own OneDrive, so it is protected by the same mechanisms as any other file there: Microsoft 365 sign-in (including multifactor authentication and Conditional Access, if your organization uses them), OneDrive permissions and your organization's Microsoft 365 policies. The web part uses a single delegated permission, *Files.ReadWrite.AppFolder*, which lets it work only in the app folder of the signed-in user's OneDrive. It cannot open other files of the user and cannot open another user's OneDrive. For details, see [KB10454. Microsoft Graph Permission Files.ReadWrite.AppFolder: Why Password Vault Needs It and How to Approve It](https://vitextra.com/en/support/kb/10454). Because the vault is kept in the user's OneDrive and not on the page, every user who opens a page or Teams tab with the web part sees only his or her own vault. Placing the web part on a shared page does not share any passwords. ## Layer 2: Encryption of the entries in the browser Before the vault is saved, Password Vault encrypts the text fields of every entry with AES. Encryption and decryption take place in the user's browser; the file travels only between the browser and the user's OneDrive through Microsoft Graph. As a result, the values are never stored or transferred as plain text: a person who opens the file sees encrypted strings instead of names, user names and passwords. The encryption key is derived from the PIN in the browser with PBKDF2-SHA256 (Web Crypto), using a random 16-byte salt and 600,000 iterations; a new salt is created whenever a PIN is set or changed. The key is not stored anywhere — not in the vault file, not in the browser storage and not at Vitextra. It exists only in the memory of the open page while the vault is unlocked. To verify a PIN, the web part derives the key from it and decrypts a check value — a known text encrypted with the key — that the file stores together with the salt and the iteration count. Neither the PIN nor a hash of the PIN is stored. As a result, the vault file alone is not enough to read the entries: the PIN is needed. ❗ **Important** The PIN has only 4 digits, that is 10,000 possible combinations. PBKDF2 makes every guess deliberately slow, but someone who obtains a copy of your vault file could still try all PINs offline, outside the web part: the limit of five attempts applies only inside the web part. Access control to your OneDrive therefore remains the first line of protection. Keep your Microsoft 365 account secure and do not share the vault file or the folder that contains it. ### What is and is not encrypted | Data in the vault file | Encrypted | |---|---| | **Name** of the entry | Yes | | **User name** | Yes | | **Password** | Yes | | **URL** | Yes | | **Notes** | Yes | | **Folder** | Yes | | **Tags** | Yes | | Favorite flag (the star) | No | | Entry identifiers, creation and modification dates | No | | Salt, iteration count and check value (used to verify the PIN) | Salt and iteration count: no; the check value is a known text encrypted with the key. The PIN, a hash of it and the key are not stored | | Microsoft Entra ID object ID of the user | No | | Failed PIN attempt counter | No | Nothing is written to SharePoint lists, to the web part properties or to the browser storage. The key and the decrypted values exist only in the memory of the open page while the vault is unlocked. ### Existing vaults are upgraded automatically Vaults created with earlier versions of Password Vault use the previous file format, in which the key was derived from a SHA-256 hash of the PIN stored in the file and the user's Microsoft Entra ID object ID. The first time you enter the correct PIN in the new version, the web part re-encrypts all entries with a new key derived with PBKDF2 and saves the vault in the new format. The entries and their modification dates are kept, and the failed-attempt counter is reset. You do not need to do anything. After the upgrade, the file no longer contains the PIN hash. 📝 **Note** The upgrade changes only the current vault file. Earlier versions of the file that OneDrive keeps in its version history or recycle bin, and copies in backups, remain in the previous format, in which the entries could be decrypted from the file itself, without the PIN. Who can open them is governed by OneDrive access control and by your organization's retention and backup settings. ## Layer 3: The PIN and the locked vault The PIN is a 4-digit code that the user sets when the vault is created (see [KB10442. How to Set Up Your PIN in Password Vault](https://vitextra.com/en/support/kb/10442)). It is needed once, to open the vault: the web part checks it as soon as the fourth digit is typed. Until then the vault is locked, and the web part shows no entries at all — not even their names. Instead of the list, it shows the **Enter PIN** prompt with "Enter your PIN to proceed" and four digit boxes, and the toolbar offers only the **Refresh** button. | Action | Available while the vault is locked | |---|---| | View the list with the name, user name, URL, folder, tags and notes of the entries | No — the list is hidden | | Show a password (eye button) or **Copy to Clipboard** for a password or a user name | No | | **New Item**, **Edit**, **Remove** | No | | **Change PIN** (the **Configure** gear) | No | | **Add to favorites** / **Remove from favorites** | No | | **Search** and filter | No | | **Refresh** | Yes | After the correct PIN, the vault is unlocked and all these actions work directly, without asking for the PIN again, until the vault locks. ![The Enter PIN prompt of a locked vault](https://static.vitextra.com/articles/10452/enter-pin-dialog-en.png) *The Enter PIN prompt of a locked vault* ❗ **Important** While the vault is unlocked, everything in it — including passwords — can be shown and copied by anyone who uses your computer, until the vault locks again. Lock your computer whenever you leave it. On the **Enter PIN** prompt, the digits are masked while you type them. On the **Set up PIN** and **Change PIN** screens they are visible, so set or change your PIN where nobody can watch your screen. ## Automatic lock After the page loads, the vault is locked: no entries are shown, only the **Enter PIN** prompt. After a correct PIN the vault opens and stays unlocked while you work. When there has been no click or key press inside the web part for **5 minutes** (activity on the **Change PIN** screen counts too), the vault locks again: the list disappears, shown passwords are hidden, the key is removed from memory, and every open dialog (**New Item**, **Edit Properties**, the removal confirmation) is closed without saving. Reloading the page also locks the vault, because the unlocked state exists only in the open page. See [KB10451. Automatic Lock: When Password Vault Asks for the PIN Again](https://vitextra.com/en/support/kb/10451). ## Failed-attempt limit Each wrong PIN shows "The PIN is incorrect" and the number of **Attempts left**. The counter is stored in the vault file and is always increased from the latest version of the file, so attempts made on different devices and pages add up reliably. The **Attempts left** line is shown on the **Enter PIN** prompt whenever earlier wrong attempts exist, also after a reload or on another device. The counter does not reset with time — only a correct PIN resets it. After **5** wrong PINs in a row the vault is blocked: the web part shows only the **Reset** screen, and resetting erases all entries and the PIN. See [KB10455. Incorrect PIN Attempts in Password Vault: What Happens After Five Failed Tries](https://vitextra.com/en/support/kb/10455). ❗ **Important** A forgotten PIN cannot be recovered or reset by you, your administrator or Vitextra. Note your PIN in a safe place, and keep important credentials also in another place approved by your organization. See [KB10460. I Forgot My PIN in Password Vault: What Are My Options?](https://vitextra.com/en/support/kb/10460). ## No data at Vitextra Vitextra does not receive, store or back up vault data. The only requests from the web part to Vitextra services are the license check and usage telemetry with technical identifiers. For the full list, see [KB10363. Where Vitextra Products Store Your Data: Privacy, Data Residency and GDPR](https://vitextra.com/en/support/kb/10363). ## What Password Vault is designed for Password Vault is designed as a convenient, personal place for everyday credentials — sign-ins to web portals, partner systems, test accounts and similar entries that a user would otherwise keep in a notebook or a text file. Its protection combines Microsoft 365 access control with encryption of the stored values under a key derived from a 4-digit PIN. It is not a privileged access management system: it has no sharing between users, no administrator recovery, no audit log of its own and no master password of high strength. For administrator accounts, service accounts, shared team credentials and other highly privileged secrets, follow your organization's policy and use the tools it prescribes. For a comparison with other approaches, see [KB10440. Password Vault vs. Browser Password Managers and Enterprise Password Managers: Which to Choose](https://vitextra.com/en/support/kb/10440). ## Recommendations - Protect your Microsoft 365 account: the vault is only as safe as the account that owns the OneDrive. - Choose a PIN that is not easy to guess (avoid *0000*, *1234* or your birth year) and keep it in a safe place. - Do not share or copy the vault file: someone with a copy could try all 10,000 PINs offline. - Lock your computer when you leave it, even for a short time. - A copied password stays on the clipboard until you copy something else; clear the clipboard after use on shared computers. - If you use the vault on several devices or tabs, changes are combined automatically; press **Refresh** to see changes made elsewhere (see [KB10453. Where Password Vault Stores Your Passwords: The OneDrive App Folder](https://vitextra.com/en/support/kb/10453)). - Store only credentials that your organization allows you to keep in a personal password manager. 💡 **Tip** To find out exactly who can and cannot see your entries, see [KB10456. Who Can See Your Passwords in Password Vault](https://vitextra.com/en/support/kb/10456).