Skip to main content

Qik Vault

Qik Vault is your personal store for the secrets you work with: logins, servers, SSH keys, API tokens, secret keys, databases, .env files, key/value pairs, secure notes and files. It is zero-knowledge. Everything is encrypted in your browser (AES-256-GCM), item names included, before it leaves your device, so neither Qik nor anyone else can read it.

The vault belongs to you, not to a company, and you find it in Settings › Vault.

How to create your vault​

  1. Open Settings › Vault and select Create your vault.
  2. Passkey — add a vault passkey (Face ID, Touch ID or your phone). If your device can't, select Use codes instead to open the vault with a code on this trusted device.
  3. Save your recovery key — copy, download or print it, and keep it somewhere safe. It is your spare key if you lose your devices.
  4. Almost done — check the safe defaults, such as Auto-lock and Email recovery, and select Continue.

Your vault is ready. Pick a secret type to add your first secret.

How to add a secret​

  1. In Settings › Vault, choose a type on the Add card: Secret key, Login, Server, SSH key, API token, Database, .env file, Key / value pairs, Secure note or File.
  2. Fill in the essentials. Extra fields, notes, tags, a rotate reminder and Ask before reveal sit under More details.
  3. Select Save.

For a Secret key, paste your key or generate one as hex, Base64, letters and numbers, a UUID or a password. Logins get a password generator.

Open a secret for one-click actions, such as copying its password or username, opening its site or copying an SSH command or connection URL. Saved logins with a 2FA secret show their live codes, and SSH keys show their fingerprint.

Ways to open the vault​

The vault locks by itself. You can open it with:

  • Vault passkey — Face ID, Touch ID or your phone.
  • Trusted device — a device you trusted, plus a code from your authenticator app or email. Set up an authenticator app from Ways in › Authenticator app; it also becomes a way to sign in to Qik. See Two-factor authentication.
  • Recovery key — the spare key you saved at setup.
  • Recover by email — only if you have lost every device and your recovery key. The vault opens after a 72-hour wait. During the wait every trusted device and your email get alerts with a cancel button, so you can stop a recovery you didn't start.
note

Turn off Email recovery for strict zero-knowledge. Then only your passkey, a trusted device or your recovery key can open the vault.

Keeping your secrets safe​

  • Auto-lock — the vault locks when you are idle, and also on sleep, screen lock and sign-out.
  • Lock everywhere — locks every open vault on all your devices at once.
  • Copied secrets — the clipboard is cleared after 30 seconds.
  • Ask before reveal — a sensitive secret asks for your passkey or a code before every reveal or copy.
  • Trash — deleted secrets stay in Trash for 30 days.
  • Activity — a log of every open, change and recovery.
  • Export — an encrypted backup, or plain text after you confirm it's you.

Start over​

If you can no longer open your vault, select Start over on the locked screen. It permanently deletes your vault and every secret in it, and neither you nor Qik can get them back. Before you confirm, it lists the ways in you still have.

Plans and limits​

Qik Vault holds 10 secrets for free. It is unlimited when any of your companies is on AI Office Pro, and the company pays for it, not you.

Restricted companies

In a restricted company, owners and admins can turn off adding secrets for members whose email is on a verified company domain. Those members keep reading, copying, editing and exporting the secrets they already have, and see that their company has turned off adding secrets.