Password Vault Overview
Password Vault does not keep your credentials on the SharePoint page, in a SharePoint list or on Vitextra servers. Each user's vault is a single file in that user's own OneDrive. This article describes the file, the folder it lives in, how it is created and what to keep in mind when you work with the vault on several devices.
Summary
| Question | Answer |
|---|---|
| File name | vitextra-password-vault.json |
| Location | The app folder of the signed-in user's own OneDrive |
| Format | A JSON file; the text fields of the entries are AES-encrypted with a key derived from the PIN; the file also holds the salt, the iteration count and a check value, but neither the PIN nor a hash of it |
| How many vaults per user? | One — the same vault on every page, site and Teams tab or app |
| Who creates it? | The web part, automatically, the first time the user opens it |
| What is stored elsewhere? | Nothing: no SharePoint lists, no web part properties, no browser storage, no Vitextra servers |
| Requirement | The user must have a OneDrive in the tenant |
The app folder
Microsoft Graph gives applications a special folder in the user's OneDrive — the app folder — where an application can keep its own files without access to the rest of the user's documents. SharePoint Framework solutions use the OneDrive Apps folder for this purpose. Password Vault saves its file there through the Microsoft Graph permission Files.ReadWrite.AppFolder (see KB10454. Microsoft Graph Permission Files.ReadWrite.AppFolder: Why Password Vault Needs It and How to Approve It).
The file belongs to your OneDrive like any other file. It is subject to the same OneDrive permissions, storage, version history, recycle bin and retention settings that your organization applies to OneDrive content. Its entry fields are encrypted with a key that is derived from your PIN and is not stored in the file, so the file does not contain your entries as plain text (see KB10452. How Password Vault Protects Your Data: Encryption, PIN and Storage).
❗ Important
Do not delete, rename, move or edit vitextra-password-vault.json. Password Vault looks for the file by its name in the app folder; any change to it can make your entries unavailable.
One vault per user, everywhere
Because the file is stored in the user's OneDrive, the vault follows the user and not the page:
- Every user who opens a page with the web part sees his or her own vault. Placing the web part on a shared page or in a Teams channel does not share passwords between colleagues.
- The same vault appears on every page, site and Microsoft Teams tab or personal app where the web part is added. An entry created on one page is available on all others.
- Removing the web part from a page, or removing the whole product from the tenant, does not delete the vault file: it stays in the user's OneDrive.
How the vault file is created
When a user opens Password Vault for the first time, the web part finds no vault file and creates an empty one in the app folder automatically. The Set up PIN screen then appears. After the user saves a PIN, the vault is ready and the list shows "There are no items in this list." See KB10442. How to Set Up Your PIN in Password Vault.
If the file is deleted or moved
If the vault file is deleted, renamed or moved out of the app folder, the web part no longer finds it. The next time the user opens Password Vault, a new empty vault is created and the Set up PIN screen is shown. The entries of the old file are not shown in the new vault.
Restoring a deleted or earlier version of the file is an operation of OneDrive, not of Password Vault: use the OneDrive recycle bin or version history, as far as your organization's settings allow. The web part opens whichever file named vitextra-password-vault.json it finds in the app folder; a restored file opens with the PIN that was valid for that version of the vault, and a file in the previous format is upgraded again the first time the correct PIN is entered.
📝 Note
Vitextra does not hold a copy of your vault and cannot restore it. Backup and recovery of OneDrive content are governed by Microsoft 365 and your organization's policies.
Users without OneDrive
Password Vault requires a OneDrive for the signed-in user in your Microsoft 365 tenant. A user who has no OneDrive cannot use the web part: it shows "Sorry, something went wrong. Please refresh the page and try again." For other causes of this message, see KB10459. Why Password Vault Does Not Load: "Something Went Wrong" and Permission Errors.
Working on two devices or in two tabs
The web part reads the vault file when the page loads and keeps the data in the open page. Every save — creating, editing and deleting entries, marking favorites, changing the PIN and updating the failed-attempt counter — is sent together with the version (eTag) of the file that the change was built from. If the vault was saved elsewhere in the meantime, OneDrive rejects the save, and the web part loads the latest file and applies the change to it. Changes made on another device or in another tab are therefore not overwritten.
A change saved in one place appears in another open page after you press Refresh there, and also after the next save or unlock on that page. If the PIN was changed or the vault was reset on another device, an open page locks itself as soon as it notices this (on Refresh, on a save or on an unlock) and asks for the new PIN; the old PIN no longer works there.
💡 Tip
To see changes made on another device right away, press the Refresh button at the top right of the web part. It reloads the vault file from OneDrive and is available also while the vault is locked.
After the upgrade to the new file format
The current version of Password Vault saves the vault in a new file format, in which the key is derived from the PIN with PBKDF2 (see KB10452. How Password Vault Protects Your Data: Encryption, PIN and Storage). An existing vault is upgraded automatically the first time its owner enters the correct PIN in the new version; the entries are kept.
❗ Important
Earlier versions of the web part cannot open an upgraded vault: they show the entries with empty values and do not accept the PIN. Administrators should update Password Vault in every app catalog of the tenant — the tenant App Catalog and every site collection app catalog where the package is deployed — and users should not use earlier versions after the update. See KB10050. How to Update a Vitextra SPFx Solution in SharePoint Online and KB10361. Tenant App Catalog vs. Site Collection App Catalog: Where to Deploy Vitextra Apps.
Pages that were already open before the update still run the previous version and hold the old data in memory. Reload them before you continue working with the vault.
Privacy and data residency
Since the vault is an ordinary OneDrive file, it is stored in the same Microsoft 365 data location as the rest of the user's OneDrive. Vitextra receives no vault data. For an overview of all Vitextra products, see KB10363. Where Vitextra Products Store Your Data: Privacy, Data Residency and GDPR.
