Every password and key, sealed in your browser
Qik Vault is a personal, zero-knowledge vault for the logins, servers, keys and secrets your work runs on. Everything is encrypted on your device, unlocked with a passkey, and never readable by Qik.
Settings › Vault
UnlockedLockStripe dashboard
Login · dashboard.stripe.com
Production web 01
Server · 10.0.4.12
Deploy key
SSH key · ED25519
Orders database
Database · PostgreSQL
web-app .env
.env file · 14 keys
Webhook signing key
Secret key · Base64
Stripe dashboard
Login · dashboard.stripe.com
Encrypted in this browser · AES-256-GCM · a key per secret
Zero-knowledge by design
The vault key never leaves your devices in a form Qik can use. Neither Qik nor your company can open your secrets.
- 01
Encrypted in the browser
Each secret is sealed with AES-256-GCM under its own key before it is saved — names included.
- 02
Unlocked with a passkey
Face ID, Touch ID, Windows Hello or a security key opens the vault. A trusted device with a code, or your recovery key, works too.
- 03
Recovery you control
Email recovery waits 72 hours and can be cancelled from any trusted device, so a stolen inbox is not enough to get in.
Built for the secrets teams really keep
Logins are only the start. The vault knows what a server, an SSH key or a database looks like.
Every kind of secret
Logins, servers, SSH keys, API tokens, databases, .env files, secret keys, notes, files and key/value pairs.
One-click actions
Copy password, Copy username, Open site, Copy SSH command or Copy connection URL, straight from the secret.
Live 2FA codes
Keep the authenticator code beside the login it belongs to, ticking live. SSH keys show their fingerprint.
Locks itself
Auto-lock when idle, asleep or the screen locks, Lock everywhere at once, and a clipboard that clears after 30 seconds.
Sensitive secrets ask again
Mark a secret as sensitive and the vault asks for your passkey again before it shows or copies it.
Activity, Trash and export
An activity log, Trash that keeps deleted secrets for 30 days, a password generator, and encrypted or plain export.
Ready in three steps
Setup is one card with a progress bar. The defaults are safe, so there is nothing to configure before you add your first secret.
① Add a passkey
Your device’s passkey becomes the key to the vault. Prefer codes? Use an authenticator app or email codes on a trusted device instead.
② Save your recovery key
Copy, download or print it. It is the one way back in if every device is lost.
③ Your vault is ready
Pick a secret type and add it. Generate strong passwords and secret keys — hex, Base64 or UUID — as you go.
For companies
Admins of restricted companies can turn off adding secrets per member on a verified company domain. Existing secrets stay readable and exportable.
Set up your vault
Add a vault passkey
Face ID, Touch ID, Windows Hello or a security key opens your vault.
Add passkeyUse codes instead
Where the vault fits
The vault sits in your Settings, beside your sign-in security.
Sign in safely
Two-factor sign-in with an email code, an authenticator app or a passkey keeps the account itself locked down.
Unlock the vault
A separate vault passkey opens your secrets, so a signed-in session alone is not enough.
Use the secret
Copy it, open the site or the SSH command, and let the clipboard clear itself.
Keep files apart
Shared work stays in the room’s Files; private keys and .env files stay sealed in your vault.
Who runs on Qik Vault
Servers, keys and .env files
Keep SSH keys with their fingerprints, database URLs and environment files where the copy command is one click away.
The logins a team runs on
Supplier portals, admin consoles and social accounts, each with its live 2FA code beside the password.
One vault across every company
People in several offices keep one vault, and get unlimited secrets as soon as any of their companies is on Pro.
One company, one office, one shared state
Qik Vault, answered
No. Qik Vault is zero-knowledge: every secret, including its name, is encrypted in your browser with AES-256-GCM before it is saved, and the key that opens it never reaches Qik in a usable form.
With a vault passkey (Face ID, Touch ID, Windows Hello or a security key), with a trusted device and an authenticator or email code, or with your recovery key. Email recovery is on by default and waits 72 hours, cancellable from any trusted device.
Ten secrets on every plan. When any of your companies is on AI Office Pro, your vault is unlimited — the company sponsors it, and you keep one vault across every office you belong to.
Use your recovery key, or recover by email after the 72-hour wait. If every way in is lost, Start over deletes the vault for good — neither you nor Qik can get those secrets back.
Admins of restricted companies can stop members on a verified company domain from adding new secrets. Their existing secrets stay readable, copyable and exportable. Personal and unverified-domain accounts always keep their vault.
Deploy AI project managers across your office
Unlimited agentic rooms and AI project managers on every plan. Start free, or walk through your office with us.