coding cordsTry Coding Cords

Vault and security

Keep the company's secrets where we can't read them

Logins, two-step codes, environment files and company cards are encrypted on your device before they are sent. We store scrambled data and keys we can't open, in the same workspace as your tasks and invoices. It is part of every plan, with no per-person password manager or secrets subscription beside it, and Cord and other AI tools are kept out of it.

Try Coding Cords

14 days, up to 10 people, no card

Features last checked 14 October 2026. Products change; tell us if something is out of date.

What it does

What the Vault does

Eleven things people do with it, each as it works today.

Encryption

Encrypted on your device, not on our server

Everything is locked and unlocked in your browser, the command line or the Chrome extension. The server holds ciphertext and public keys, so a copy of our database does not contain your passwords.

  • Each person has a key pair. The private half is wrapped under a key made from the master password with Argon2id, and it lives in the tab's memory only. Reload, close the tab or press Lock and it is gone.
  • Each collection has its own random 256-bit key, sealed to every member, to every token and to the company recovery key.
  • Each item has a key of its own, so moving an item to another collection re-wraps one small key and leaves the content as it is.
  • Item names and everything inside items are encrypted. Collection names and who can open what are readable by the server, and the security page says so.
  • The web app, the command line and the extension share one crypto package, so an item made in any of them opens in the others.

Everyday use

Type to find it, click to copy it

The vault opens with the search box focused. Start typing anywhere on the page, press Enter to open the best match, and copy what you came for.

  • Search covers names, subtitles, web addresses, usernames, card holders and what a card pays for. Escape clears it.
  • Hover a login and the row offers copy username, copy password and open website, so the usual job takes one click.
  • Copied secrets are cleared from the clipboard after 30 seconds, and a toast says so.
  • A masked field shows when you ask, and each reveal is recorded. Passwords come with a generator: 20 characters from every class, with look-alikes such as l, 1, O and 0 left out.
  • Each login's password is rated Strong, Fair or Weak and marked when another login you can open uses the same one.

Two-step codes

The code sits beside the password

Add a site's two-step secret to its login and the live code appears under the password, with a ring that counts down and turns amber in the last five seconds. A shared account no longer depends on one person's phone.

  • Paste the otpauth link or the bare secret, or drop or paste a screenshot of the QR code. The field reads "Set for GitHub · ann@acme.co" once it has understood it.
  • The code shows in two halves, such as 482 913, with a copy button. The Chrome extension can fill it into the page's code field.
  • The codes follow the standard in RFC 6238, and tests check them against its published vectors.
  • A login also keeps website, username, password and notes, so the whole sign-in is one item.

Secret sets

Environment files for each environment

A secret set holds the variables of a project, with Development, Staging and Production kept apart. You can add or remove environments, and each one has its own key.

  • Paste a whole .env into an environment. Comments, export, quotes and multi-line values are understood, the button says "Add 12 variables", and badly formed names turn red.
  • Copy an environment as .env, or download it. Production saves as .env and the others as .env.staging and so on, and the download is recorded.
  • Compare shows every variable against every environment: a tick where it is set, "same" where the value matches the first environment, an amber dash where it is missing. Values are never shown in the grid.
  • A missing variable shows up before the deploy fails on it, and nobody has to pass a .env file around in chat.

Tokens for deploys

Secrets for CI: one environment and nothing else

An admin makes an access token, names it and ticks exactly which environments of which secret sets it may read. A token can read Production and not Staging. Put it in your CI as CORDS_TOKEN and the job reads its secrets when it runs.

  • The token carries its own key, so the server stores only a hash of the secret. A request that tries to send a private key to us is refused, and a test guards that.
  • The token is shown once, with Copy and the commands to use it. Revoke is one click, and a revoked token is refused at once.
  • The cords command line reads it. cords run --set api --env production -- npm start starts your program with the secrets as environment variables, and cords env pull writes a .env with owner-only permissions.
  • The list shows each token's scope, such as "api · production", and "Used 2 hours ago" or "Not used yet". Every read by a token is on the activity record.
  • A full-access token opens everything its maker can open and acts as them, for scripts. It stops when its owner loses access or stops being an admin.

AI

AI tools can't read the Vault

Cord works across the rest of the workspace. The Vault is the one place it is shut out of, and so is every AI tool you connect through MCP.

  • The Vault is a denied source for Cord and for search. A test checks that nothing from it, or from pay and sign-in records, is ever sent to the AI.
  • The MCP tools leave the Vault out, and the guide each tool reads says so. Any AI tool that supports MCP, such as Claude, ChatGPT, Cursor and Antigravity, gets the same answer.
  • Item names and contents are encrypted on your device, so the server has nothing readable to hand to an AI even by mistake.
  • An API key given to an AI tool can't change security settings such as passkeys or two-step. Only the web app can.

Sharing

Share by collection, with three plain roles

Everyone has a Personal collection that is theirs alone. Shared collections hold what a team needs, such as Engineering, Finance or Clients, and the key is sealed to each person in the browser as they are added.

  • Can view reads and copies. Can edit changes items. Manages shares the collection and changes roles.
  • The last manager can't leave until someone else manages the collection, so no collection ends up without an owner.
  • Someone who has not set up their vault can't be added yet. The list says "Everyone with a vault is here" when nobody is left to add.
  • Removing a person from a collection also takes it from their full-access tokens.
  • A person with no access gets "doesn't exist", so they can't tell whether a collection is there. Admins see who can open what on the Access sheet, and the contents stay sealed even from them.

Unlock and recovery

Strong encryption without the lockout risk

You unlock with a master password or a passkey. If someone forgets the password, an admin gives back what was shared with them using the company recovery code, without seeing any of it.

  • The passkey, through Face ID, Touch ID or a device PIN, wraps your private key, and nothing about it reaches the server. Each passkey is named after its device and shows when it was last used.
  • Eight wrong master passwords pause unlocking for 15 minutes, and while it is paused the server stops sending the wrapped key. A test guards this rule.
  • The master password needs at least 10 characters and can't be rated weak. A coloured dot shows its strength as you type.
  • The first admin sets up the vault and saves a company recovery code, shown once, with Copy and Download. The key is stored only after they tick that they saved it.
  • Someone who forgets starts again with new keys and their shared collections show Waiting. An admin opens Recover access, enters the code, and each collection is re-sealed to the new keys in the browser.

Activity

A plain record of who opened, copied and shared what

The vault keeps a record in sentences, newest first, for one item or for the whole vault. When someone leaves or something leaks, you know which passwords to change.

  • Lines read "Ann copied GitHub (password)", "Ben shared Finance with Cara" and "Token Production deploys read its secrets".
  • It records unlocks, wrong-password pauses, passkeys added or removed, sharing and role changes, items added, changed, moved or deleted, and views, copies, reveals and .env downloads. Events stay after the item is deleted.
  • Admins see everything. Members see events in their own collections and their own actions.
  • The vault also feeds the company audit log, with item contents and passkey material kept out of it.
  • That log lists who, when, IP address and device, with a Field, Before, After table. The database refuses to update or delete an event, and the plan decides how far back it shows: 90 days on Starter, 1 year on Company, 3 years on Enterprise.

Chrome extension

Fill where you sign in, and only on the right site

A small Coding Cords mark appears inside sign-in fields and opens a menu of this site's logins. Nothing is filled until you click one. The extension is loaded as an unpacked extension today and is not in the Chrome Web Store yet.

  • It finds username and password fields, the first step of two-step sign-ins and two-factor code fields, and leaves sign-up forms, change-password forms and newsletter boxes alone.
  • Matching uses the real domain from the public suffix list. github.com.evil.io and alice.github.io get nothing for github.com, and the site is taken from Chrome rather than from the page.
  • After you sign in with a new login, a bar offers "Save this login for example.com?". When the password changed it offers to update it, and it stays quiet when the saved login is the same.
  • Cmd+Shift+L or Ctrl+Shift+L fills the site's login. It unlocks with the master password and locks itself after 1, 5, 15, 30 or 60 minutes, or when the browser closes.

Company cards

The company card, with what it pays for

A card item holds the holder, number, expiry, CVC, billing address and a Pays for line such as "AWS, Figma, Google Workspace". The next person to renew finds out which card is behind which tool.

  • The brand is recognised (Visa, Mastercard, Amex, Discover, Diners, JCB, UnionPay and Maestro), and the number is grouped as printed.
  • A number check warns "This number doesn't look right" when it fails.
  • The card view shows the number masked. It warns "This card has expired", and "expires within 30 days" ahead of time.
  • A card sits in a collection like any other item, so only the people in that collection can open it.

Account security

Security for the whole account, not only the vault

Each person's Profile has a Security page. None of it needs an IT person.

  • Passkeys sign you in with Face ID, Touch ID, Windows Hello or a security key, with no extra code. Two-step verification works with any authenticator app and comes with 10 recovery codes. Each code works once.
  • "Where you're signed in" lists every browser and the Chrome extension with device, address and last use. Sign out one or all the others, and a signed-out device is refused on its next request.
  • An email arrives when a browser and system you haven't used in 90 days signs in. After 5 wrong passwords in an hour each try waits longer, up to 15 minutes, for unknown addresses too.
  • Turning two-step off or making new recovery codes asks for your password again. Passwords are hashed with argon2id.
  • Security settings can't be changed with an API key, only in the web app, so a key given to an AI tool can't take over the account.
Try Coding Cords

14 days, up to 10 people, no card

Cord here

Cord stays out of the Vault

The Vault is kept out of Cord and out of search on purpose, and a test checks that nothing from it is ever sent to the AI. You can use Cord across the rest of the workspace without a second thought about secrets. Admins can still ask it about the audit log.

  • Who signed in from a new device this week?
  • What changed on the Acme invoice last month?
  • Show everything Ana did in the audit log on Tuesday

Any AI tool that supports MCP, such as Claude, ChatGPT, Cursor and Antigravity, gets the same exclusion. The Vault, sign-in and passkeys are left out of its tools, and each action it takes is recorded as "Ana Lima · Claude Desktop".

Simple to run

Simple to run

The Vault is part of the same workspace, on every plan from Starter. There is no second subscription and no second login.

One admin sets it up once

The first admin sets up the Vault and saves the recovery code. After that, each person chooses a master password the first time they open it, and a Personal collection is made for them.

A calm screen before setup

A member who opens the Vault early sees that it isn't set up yet and to ask an admin.

Admins see access, not contents

The Access sheet lists every shared collection, who can open it and who is waiting for recovery. Contents stay sealed to admins who aren't in the collection.

Switch it off per person

On the Company plan, an admin can turn the Vault off for individual people.

Keep the log as long as you need

Owners and admins choose how long the audit log is kept: 1, 2, 5 or 7 years. The plan decides how much of it shows, and older events are kept but hidden, so changing plan never destroys history.

Fair to say

What it doesn't do yet

Where a part isn't built, it is here, and the ones we're working on carry a star.

On the roadmap

  • Import and export★Bring passwords in from another manager and take the Vault out as a file. Today the only bulk import is the command line's JSON file.
  • Browser extension in the Chrome Web Store★Autofill from the Vault, installed from the store. Today you load it as an unpacked extension.
  • SAML single sign-on and SCIM★Sign-in through your identity provider, with people added and removed from it.
  • IP allow list★Sign-in only from the networks you name.

Not in the product today

  • The command line on a package registryThe cords command line is built from the Coding Cords code and is not published to npm yet, so a CI runner needs the built file.
  • History, restore and trashDeleting an item can't be undone, and items have no earlier versions.
  • Autofill on phonesOn a phone the Vault is the web app. There is no iOS or Android password autofill, and no Firefox or Safari extension.
  • A password health reportStrength and reuse show per login. There is no list of all weak or reused passwords and no check against breached-password lists.
  • Sharing outside the companySharing is by collection with people in your company. There are no one-off share links and no per-item sharing.
  • Attachments and custom fieldsItems have no file attachments, no custom fields, no tags and no favourites.
  • Token expiryTokens are revoked by hand and don't expire on their own. They have no IP restriction.
  • Admin-enforced two-step and idle lockAn admin can't require two-step or passkeys for everyone, and the web app has no idle lock. It locks on Lock, reload or closing the tab. Only the extension has an idle timer.
  • Passkeys for other websitesThe Vault unlocks with a passkey but doesn't store passkeys for the sites you sign in to. The extension unlocks with the master password only.

Compared with

Looking at it beside your current tools

Questions

Questions people ask

Can Coding Cords read my passwords?

No. Items are encrypted on your device and the server stores ciphertext and public keys. The private key is held in the open tab's memory and is never stored. Collection names, item kinds, environment names and who can open what are visible to the server and to admins. Item names and everything inside items are encrypted.

What if someone forgets their master password?

They start again with new keys, and their shared collections show Waiting. An admin enters the company recovery code in Recover access and each collection is re-sealed to the new keys, without the admin seeing it. If the recovery code and the passwords are all lost, the data can't be recovered, which is how end-to-end encryption works.

Do I pay extra per person for the Vault?

No. The Vault is part of every plan, with no separate password manager or secrets subscription. Everyone with a seat can use it, and an admin on the Company plan can switch it off for a person.

Can my AI tools or Cord see what is in the Vault?

No. The Vault is a denied source for Cord and for search, the MCP tools leave it out, and a test checks that nothing from it is sent to the AI. Its contents are also encrypted on your device.

How do I give a deploy its secrets?

Make an access token that can read one environment, for example Production of the api set, and put it in CI as CORDS_TOKEN. With the cords command line on the runner, cords run --set api --env production -- npm start starts your program with the variables set. Revoke the token in one click if it leaks.

Can I install the Chrome extension?

Today you load it as an unpacked extension, and a Chrome Web Store listing is on the roadmap. It fills logins and two-step codes and offers to save new logins. Secret sets open in Coding Cords, and new items made in the extension are logins only.

Is every view and copy certain to be in the activity record?

Server actions are recorded by the server. Views, copies, reveals and downloads are reported by your browser or the extension, so a modified client could skip reporting them.

Put your first login in the Vault

Set it up as admin, choose a master password and save the recovery code. Paste a .env or drop a QR code, and the team's secrets stop living in chat.

Try Coding Cords

14 days, up to 10 people, no card

★ On our roadmap. Released once it's tested.