Password Vault Overview
Password Vault stores each user's entries in one encrypted file, vitextra-password-vault.json, in the app folder of that user's own OneDrive. Who can see your entries therefore depends on who can access your OneDrive and who can use your signed-in computer — not on who can open the page. The answers below go through the typical cases.
| Who | Can see your entries? |
|---|---|
| Colleagues who open the same page | No — they see their own vaults |
| Members of a Teams channel with a Password Vault tab | No — each member sees his or her own vault |
| Page owners and site administrators | No — nothing is stored on the page or the site |
| Microsoft 365 / OneDrive administrators | They can access the file like any other file in your OneDrive, but cannot read the entries without the PIN; with a copy of the file, they could try all 10,000 PINs offline |
| Vitextra | No — Vitextra receives no vault data |
| Someone at your unlocked computer | Without the PIN, nothing — not even the names of the entries; everything while the vault is unlocked |
Can colleagues who open the same page see my passwords?
No. The web part always opens the vault of the person who is signed in. If ten colleagues open the same SharePoint page, each of them sees only his or her own entries, read from his or her own OneDrive. Placing Password Vault on a shared page does not share any passwords.
Can members of a Teams channel see my passwords?
No. A Password Vault tab in a Teams channel works like the web part on a page: every channel member who opens the tab sees his or her own vault. It is the same vault that the member sees on SharePoint pages and in the personal app. See KB10457. How to Add Password Vault to Microsoft Teams.
Can page owners or site administrators see my passwords?
No. Password Vault stores nothing in SharePoint lists, libraries or the web part properties; the page holds only the web part and its title. Owning a page or a site, or being a site collection administrator, gives no access to the vault files of the people who use it.
Can Microsoft 365 or OneDrive administrators see my passwords?
Password Vault has no administration console: administrators cannot view, manage, unlock or recover vaults through the product.
The vault file itself is an ordinary file in your OneDrive and is protected by Microsoft 365 and OneDrive access control. Like any other file in your OneDrive, it can be accessed by administrators who have, or give themselves, access to your OneDrive under your organization's policies — for example during an investigation, through compliance tools or when the OneDrive of a departed employee is handed over. Its entry fields are encrypted with a key that is derived from your PIN and is not stored in the file, so access to the file alone does not let an administrator read your entries. However, the PIN has only 4 digits: someone with access to the file could copy it and try all 10,000 PINs offline. PBKDF2 slows down every guess, and the limit of five attempts applies only inside the web part.
❗ Important
Against someone who tries all PINs on a copy of the file, a 4-digit PIN offers only limited protection, so OneDrive access control remains the first line of protection. Password Vault is intended for personal, everyday credentials. For administrator accounts, service accounts and other highly privileged or shared credentials, follow your organization's policy. See KB10452. How Password Vault Protects Your Data: Encryption, PIN and Storage.
Can other apps in my organization access the vault file?
The vault is saved through the Microsoft Graph permission Files.ReadWrite.AppFolder. In SharePoint Online, this permission is granted to one application shared by all SharePoint Framework solutions in the tenant, so other SPFx solutions deployed in your organization that use the same permission work with the same app folder on behalf of the signed-in user. Such a solution could read or change the vault file; the entries in it are encrypted with a key derived from your PIN, with the limitation described in the previous section. Administrators should deploy only SPFx solutions they trust. See KB10454. Microsoft Graph Permission Files.ReadWrite.AppFolder: Why Password Vault Needs It and How to Approve It.
Can Vitextra see my passwords?
No. Encryption and decryption happen in your browser, and the vault file is transferred only between your browser and your OneDrive. Vitextra does not receive, store or back up vault data, your PIN or the key derived from it. The web part sends Vitextra only the technical identifiers of the license check and usage telemetry; see KB10363. Where Vitextra Products Store Your Data: Privacy, Data Residency and GDPR.
What can someone at my unlocked computer see?
Anyone who can use your browser while you are signed in to Microsoft 365 can open a page with Password Vault. Without the PIN, that person sees no entries at all — not even their names:
- instead of the list, the web part shows only the Enter PIN prompt, and the toolbar offers only the Refresh button;
- passwords, user names, URLs, folders, tags and notes are not shown, and New Item, Change PIN, Search, the filter and the favorites are not available;
- the person can type PINs, and every wrong PIN counts toward the limit of five (see below).
Once the correct PIN has been entered, every action — showing and copying passwords, New Item, Edit, Remove and Change PIN — works without asking for the PIN again.
After you have entered the PIN, the vault stays unlocked while the page is open and in use: anyone at the computer can show and copy passwords and change entries until the automatic lock applies after 5 minutes without interaction (see KB10451. Automatic Lock: When Password Vault Asks for the PIN Again). A password that you copied also stays on the clipboard until something else is copied.
Someone who does not know the PIN can also enter wrong PINs. Five wrong PINs in a row block the vault, and the only way out is a reset that erases all entries (see KB10455. Incorrect PIN Attempts in Password Vault: What Happens After Five Failed Tries).
💡 Tip
Lock your computer every time you leave it, and set or change your PIN where nobody can watch the screen: on the Set up PIN and Change PIN screens the digits are visible while you type them (on the Enter PIN prompt they are masked).
Can I share an entry with a colleague on purpose?
No. Password Vault is a personal vault: there are no shared entries, shared folders or team vaults. For credentials that a team must share, follow your organization's policy.
