Password Vault Overview
Password Vault asks for a 4-digit PIN to open the vault; until then, it shows no entries. To make guessing the PIN harder, the number of incorrect attempts is limited: after five wrong PINs in a row the vault is blocked and can only be reset, which erases all entries. This article describes how the attempts are counted and what the reset does.
Summary
| Question | Answer |
|---|---|
| How many wrong PINs are allowed? | 4; the 5th wrong PIN in a row blocks the vault |
| Where is the counter kept? | In the vault file in the user's OneDrive |
| Does it count across devices, pages and Teams? | Yes, it belongs to the vault, not to the page or the browser, and it is always increased from the latest vault file |
| Does it reset with time? | No |
| What resets it? | A correct PIN (and a PIN change) |
| What happens after 5 wrong PINs? | Only the Reset screen is shown; Reset, after a confirmation, erases all entries and the PIN |
| Can an administrator or Vitextra unlock the vault? | No |
When a PIN is wrong
While the vault is locked, the web part shows the Enter PIN prompt instead of the entries. It checks the PIN as soon as the fourth digit is typed; the digits are masked while you type them. If the PIN is wrong, the boxes are cleared and the prompt shows:
- "The PIN is incorrect"
- Attempts left: the number of tries that remain before the vault is blocked.
The Attempts left line is shown on the prompt from the start whenever earlier wrong attempts exist — also after the page is reloaded or on another device — and not only after a failure on the current page. You can try again at once or leave the page and come back later. Leaving or reloading the page does not reset the counter.
How the attempts are counted
The failed-attempt counter is saved in the vault file in your OneDrive after every wrong PIN. Because of this:
- attempts made on different devices, browsers, pages and in Microsoft Teams add up — they all work with the same vault, and the web part always increases the counter from the latest vault file;
- reloading the page, signing out or waiting does not reset the counter;
- the counter is reset to zero after a correct PIN. Changing the PIN also resets it.
📝 Note
Before every PIN check, the web part reads the latest vault file, so the check and the counter always use the current state, even if attempts were made on another device while your page was open. The Attempts left value shown before you type may still come from the moment your page loaded the vault; press Refresh to update it.
After five failed tries: the Reset screen
The fifth wrong PIN in a row blocks the vault. The web part no longer shows the list of entries; instead, it shows the Reset screen with the message "You've entered an incorrect PIN too many times." and a single Reset button. No other action is available, and the entries cannot be opened. The screen appears on every page and device where you open Password Vault until the vault is reset.
What the reset does
Clicking Reset opens the Confirmation dialog with the text "Are you sure you want to reset your vault? This action will delete all your passwords stored in the vault." and the Cancel and Reset buttons. Only after you click Reset in this dialog is the vault file emptied:
- all entries — names, user names, passwords, URLs, notes, folders, tags and favorites — are deleted;
- the PIN and the failed-attempt counter are removed;
- the Set up PIN screen appears, and you start with an empty vault under a new PIN (see KB10442. How to Set Up Your PIN in Password Vault).
❗ Important
The reset cannot be undone in Password Vault. Before you click Reset, make sure you can restore access to the accounts stored in the vault in another way, for example through the password recovery of each service.
If, in the meantime, the vault was unlocked with the correct PIN on another device, the block has been lifted: the reset is not carried out, and the web part shows the locked vault with the Enter PIN prompt as usual. If the reset cannot be saved, the screen shows the red error bar "Sorry, something went wrong. Please refresh the page and try again."
The vault is reset only from this screen: Password Vault has no command to reset the vault voluntarily.
No administrator unlock
The counter and the data used to verify the PIN live only in your vault file; the PIN itself is not stored anywhere. There is no unlock function for administrators, and Vitextra stores no copy of your vault, your PIN or a recovery key. Neither your Microsoft 365 administrator nor Vitextra support can unblock the vault, recover the PIN or restore the entries. Likewise, there is no way to recover a forgotten PIN; see KB10460. I Forgot My PIN in Password Vault: What Are My Options?.
How to avoid a blocked vault
- Note your PIN in a safe place.
- After two or three wrong attempts, stop and check that you are typing the right PIN instead of trying further combinations.
- Lock your computer when you leave it: anyone who can use your signed-in browser can enter wrong PINs, and five of them block your vault.
- Keep important credentials also in another place approved by your organization.
💡 Tip
If the vault is already blocked, see KB10461. Why Password Vault Is Blocked: "You've Entered an Incorrect PIN Too Many Times". For an overview of all protection layers, see KB10452. How Password Vault Protects Your Data: Encryption, PIN and Storage.
