Password & Secrets Vault

Backbuild Secrets is the password and secrets manager built into every Backbuild workspace, free on every plan. It stores logins, cards, identities, API keys, SSH keys, and more in encrypted vaults you can share with your team under role-based access control. It is zero-knowledge: everything is encrypted on your device with keys derived from your vault master password, and Backbuild stores only ciphertext and cannot read your secrets. The encryption is post-quantum, so a future quantum computer that harvests today's ciphertext still cannot open it.

How the Vault Protects You

When you first open the vault you set a master password of at least fourteen characters, mixing upper case, lower case, a digit, and a symbol. That password never leaves your device. It is stretched with Argon2id, the memory-hard function that won the Password Hashing Competition, into a master unlock key that exists only in your browser or app. The master unlock key wraps a pair of private keys that are generated on your device and sealed before they are stored, so the server only ever holds your public keys and a sealed blob it cannot open.

The key exchange that protects your vault is hybrid post-quantum: it combines X25519 with ML-KEM-768, the key-encapsulation mechanism standardized by NIST as FIPS 203, and signs critical state with ML-DSA-65, standardized as FIPS 204. Each vault has its own random key that encrypts every item's contents with XChaCha20-Poly1305 authenticated encryption, and that vault key is wrapped separately to each member's public key. Sharing a vault re-wraps its key to the new member's public key on the granting member's device; the server never sees a vault key in the clear.

Because the design is zero-knowledge, there is no password reset. If you forget your master password, no one at Backbuild can recover it for you. Instead, initialization prints a one-time Emergency Kit with a recovery secret you store safely offline. Organizations can additionally enable administrator-assisted recovery, where a member escrows their keys to an administrator's public key in advance, so a designated administrator can help that member reset without any Backbuild employee ever being able to open a vault.

Vaults and Sharing

Every person starts with a Personal vault that cannot be deleted or transferred away. You can create additional named vaults for a team, a project, or a client, each with its own icon and color. Sharing uses three roles that map onto a granular permission set:

  • Member can view and use the secrets in the vault.
  • Manager can also create, edit, and delete items and add members.
  • Owner can additionally manage members and roles and rename or delete the vault. A vault always keeps at least one owner.

Every create, edit, delete, share, and role change is written to a tamper-evident audit log with the actor, the time, and the target, and never the secret value. Vaults are isolated per organization, so one tenant's secrets are never reachable from another. These controls are on every plan, including Free, not reserved for a business tier. See Security & Compliance for the wider posture.

Item Types and Fields

The vault ships the full set of item categories you expect from a mature password manager, so an import from another tool lands in the right shape: Login, Password, Secure Note, Credit Card, Identity, Document, API Credential, Bank Account, Crypto Wallet, Database, Driver License, Email Account, Medical Record, Membership, Outdoor License, Passport, Reward Program, SSH Key, Server, Social Security Number, Software License, Wireless Router, and a fully Custom category.

Any item can carry custom sections and custom fields with typed inputs, including text, concealed password, email, URL, phone, date, one-time password, address, number, a reference to another item, and a passkey record. Items support tags, notes, file attachments, a favorite marker, archive and trash, and version history that keeps the last fifty values of a field so you can view and restore a previous one. A one-time-password field stores an otpauth secret and renders a live thirty-second code with a countdown, so your two-factor codes live beside the login they belong to.

A passkey field stores the metadata of a passkey as a reference record, the way you would file any other credential. It is a record, not a working authenticator: the vault does not create passkeys or sign WebAuthn challenges today. If your first requirement is a vault that acts as a passkey authenticator, that is on the roadmap rather than shipped.

Generating and Checking Passwords

The built-in generator produces strong passwords, memorable passphrases, or numeric PINs from a cryptographically secure random source, with controls for length and character classes. The vault also checks password hygiene for you: it flags weak passwords, flags passwords reused across items, and checks whether a password appears in a known-breach corpus. The breach check is itself zero-knowledge: it hashes your password locally, sends only the first five characters of that hash to the Have I Been Pwned range API, and matches the rest on your device, so the password and its full hash never leave your machine.

Importing From Another Manager

You can bring your existing logins with you. The vault imports exports from 1Password, LastPass, Bitwarden, Dashlane, and KeePass, as well as the CSV that browsers produce, detecting the format and mapping fields into the right item categories. Because the vault is zero-knowledge, importing and the encryption that follows happen on your device.

Secrets for Machines and Services

The same vault holds infrastructure and service secrets, not only human passwords. A command-line tool authorizes a specific machine to a specific set of vaults and injects secrets into a process at launch, so you can replace scattered .env files with one authoritative, encrypted source. The full workflow, including the machine-authorization ceremony and the grant lifecycle, is covered in Secrets from the CLI.

Secrets and AI, Without Leaking Values

Backbuild is AI-native, and the vault is built so that an assistant can help with secrets without ever seeing one. AI tools can check whether a vault is set up, list the names, descriptions, and target sites of items, and generate a new password into a named slot, but there is no tool that returns a plaintext value, because none exists. When a secret is actually needed to run a command, a trusted path outside the model substitutes the real value at the moment of use and keeps it out of the model's context, its results, and the logs. Virtual Workers, the platform's autonomous machine identities, get their own escrowed vaults so they can use secrets on their own, and those vaults are shared with organization administrators so a human can always audit and manage them.

Where You Use It

The vault runs in the Backbuild web app and in the Windows and macOS desktop app. The Backbuild browser extension, which adds autofill on the sites you authorize, is on its way to the Chrome Web Store, Firefox Add-ons, and the App Store as a Safari extension; until it lands there, autofill on third-party websites is not yet available to install. See the Browser Extension guide for what it will do and how it is designed. Native mobile apps are not available yet.

See Also