Email and account password
How Velora Vault works
Two credentials. One clear security model.
Your account password proves who you are. Your master key unlocks your encrypted vault. Keeping those roles separate makes the journey easier to inspect.
Account access and vault decryption remain separate.
Used with your email to authenticate your Velora Vault account.
Used in the browser to encrypt and decrypt vault contents.
Optional memory assistance that never contains or recovers the key itself.
The important distinction
Signing in is not the same as unlocking.
Authentication can prove that an account belongs to you, but it should not silently reveal the key that decrypts its private vault data.
Identity first, decryption second.
Velora first verifies the account and active membership. The browser can then fetch owned ciphertext. Only the correct master key turns that ciphertext back into readable vault contents.
Built for the real task
The journey from account to unlocked vault
Each stage has a narrow responsibility and a visible failure boundary.
Email confirmation
A confirmation link verifies the address before vault setup continues.
Separate master key
The master key is created after account confirmation and never doubles as the sign-in password.
Browser-side encryption
Readable records are encrypted before database or object storage receives them.
Authorization checks
Owned ciphertext is returned only when the account has an active membership.
Session-only unlock
The master key stays in memory for the active unlocked session and clears when the security context changes.
Honest recovery
Password reset restores sign-in only. It does not decrypt records created with a lost master key.
Five stages
From new account to private workspace.
The ordered flow keeps authentication, authorization, and encryption from becoming one vague promise.
- 01
Create and confirm
Set account credentials and confirm the email address.
- 02
Set the master key
Choose the secret used to derive encryption keys in the browser.
- 03
Encrypt before sending
Velora encrypts each approved record with a fresh salt and IV.
- 04
Store ciphertext
Database and private object storage receive encrypted contents tied to the owner.
- 05
Unlock locally
After sign-in, enter the same master key to decrypt fetched ciphertext on the device.
What recovery can do
A hint helps memory. It does not weaken the boundary.
The optional hint can be retrieved for the authenticated account. It should remind you of the key without containing the key. If the master key is lost, previously encrypted contents remain unreadable.
Read the security architecture- Account password reset restores authentication only
- A hint cannot reveal or reset the master key
- PIN and biometrics are local convenience wrappers
Common questions
Before you begin.
Where is the master key stored?
It is held in browser memory while the vault is unlocked. Local PIN or biometric setup can store an account-bound wrapped form on that device.
What happens when the vault locks?
The active readable key material is cleared from the vault session. You must unlock again to read encrypted contents.
Does changing my account password change the master key?
No. Account authentication and vault encryption use separate credentials and separate recovery paths.
Start free
Start with a security model you can explain.
Create your account, confirm your email, and set the separate key that protects your vault.