Workspace / Desktop vault
Local vault
OFFLINE DESKTOP ACCESS

Access stays
local.

One private vault for your Ubuntu desktops.
Automatic rotation, even when they’re disconnected.

01
One seed for each desktop

Unique credentials. A common local agent.

02
Custom password rotation

The agent works independently of this vault.

03
Ready when you need access

Calculate the expected password in your browser.

YOUR ENCRYPTED VAULT

Unlock your vault

Enter your passphrase to access desktop credentials.

Locks automatically after 20 minutes of inactivity.
ADD A DESKTOP

Enroll a desktop

Create its unique seed and choose its password change frequency.

A label for this desktop. Use letters, numbers, dots, dashes or underscores.

An existing, unlocked local account on the desktop.

The rotation schedule starts at midnight UTC on this date.

Change every selected number of days, weeks or calendar months. Default: every 6 months. Set this before provisioning the desktop.

The agent changes the Linux password. It does not synchronize GNOME’s login keyring.
DESKTOP CREDENTIALS

Desktop

Frequency is set at enrollment and included in the offline setup bundle.

Automatically hides after 30 seconds.
Application on the desktop is unconfirmed. A previous period’s password works only if that period is still applied locally.

Desktop setup bundle

The common script, timer and this desktop’s secret configuration.

Treat the downloaded bundle as a secret. Transfer it only to the intended desktop.

Remove from inventory

Deleting removes this desktop’s record and secret seed from this vault. The offline desktop keeps rotating its password. Keep its setup bundle or a vault backup if you need to recover future passwords.

Existing downloads and older backups are not deleted. Enrolling the same name again creates a new seed and will not match the existing desktop.
VAULT SETTINGS

Protect your vault

Encrypted backup

Save an encrypted copy after enrolling desktops. Keep its passphrase separately.

Change vault passphrase

This re-encrypts the vault and locks all browser sessions. Desktop passwords stay on their existing schedule.

Older backups still require their original passphrase.