FAQ & Knowledge Base

Only someone who knows both the case slug and the passphrase you chose. The server stores only encrypted data. Operators, system administrators, and anyone who gains access to the storage files still cannot read the content without the passphrase.

No. Encryption and decryption happen entirely in your browser. The passphrase is used locally to derive keys and is never transmitted. Only ciphertext, a salt, an initialization vector, a revision number, and a one-way authorization hash are sent to the server.

Authenticated encryption with AES-256-GCM. This provides both confidentiality and integrity: any tampering with the stored data causes decryption to fail rather than returning corrupted text. The encryption key is derived from your passphrase using a slow key-derivation function designed to resist brute-force guessing.

A separate write-authorization token is derived from your passphrase when the vault is created. The server stores only a one-way hash of that token. Every save and every permanent deletion must present the token. Simply knowing or guessing the slug does not grant write or destroy rights.

In limited form, yes — an existence check can confirm whether a given slug has data. For that reason, treat the slug itself as sensitive. Prefer identifiers that are not obvious from a person’s real name or publicly known case numbers when the context is high-risk.

Yes on a correct deploy. This build requires HTTPS. HTTP requests are redirected or refused. Cloudflare / CloudAccess forwarded HTTPS is accepted. Storage folders vaults/ and logs/ are denied by Apache. The API also rejects posts from a different website origin.

That line is your connection fingerprint for rate-limiting only: address family, a masked IP (last part hidden), HTTPS, and whether a CDN/proxy header is present. It is not a location lookup. It does not show city, ISP, or a full IP. Other visitors cannot use it to learn your address.

Only whether the service is operational or degraded (crypto, storage write test, protection). It does not print PHP versions, file paths, the host secret, vault names, or log contents.

If malicious software already has the ability to read the memory of your browser while a vault is unlocked, it can potentially access the decrypted content. This is a limitation of any client-side encryption system. Mitigations: keep sessions short, lock when you step away, use the Safety Exit, and prefer a clean browser profile without unnecessary extensions when working with highly sensitive material.

No. There is no recovery mechanism, no reset email, and no administrator override. This is intentional. If the passphrase is lost, the encrypted data cannot be decrypted by anyone — including the people who operate the server. Store your passphrase in a place you control and trust.

No. Administrators do not possess the encryption key and have no technical means to derive it. The system is designed so that even full access to the server and storage cannot produce the plaintext.

Decryption fails and you remain locked out of that vault. Repeated failed attempts are rate-limited to slow automated guessing. After a number of failures, further tries from the same source are temporarily blocked.

Not in the current design without re-encrypting and re-creating the vault under a new passphrase. Because the key is derived directly from the passphrase, changing it requires decrypting with the old key and encrypting again with a new one. Plan your passphrase carefully at creation time.

Sharing means sharing the passphrase (and the slug). Anyone who has both can open and modify the vault. There is no built-in multi-user permission system. If shared access is required, use a strong unique passphrase, communicate it through a secure channel, and understand that either party can change or destroy the content.

On the home screen enter a unique case slug and a strong passphrase, then choose Enter Vault. If no vault exists for that slug, a new encrypted vault is created. Choose a slug that is hard for others to guess.

Enter the same slug and passphrase used at creation, then Enter Vault. If the passphrase is correct the content is decrypted in your browser and the session begins.

You can save at any time with the Save button or Ctrl+S. The application also auto-saves periodically when there are unsaved changes. Each save encrypts the current content and sends only ciphertext to the server. Concurrent sessions are protected by revision checks so one does not silently overwrite another.

After a period of inactivity the vault locks automatically and the encryption key is cleared from memory. The timer is visible in the header. Any interaction resets it. This reduces the window during which decrypted content is present if you step away.

Yes. While a vault is open, use the Print control. The browser’s print dialog opens with the current decrypted content. Be aware that printed or PDF output is no longer protected by the vault’s encryption — treat printed copies as sensitive physical documents.

Letters, numbers, hyphens, and underscores only, up to 64 characters. Spaces and special symbols are not accepted. The slug is normalized to lowercase.

Yes. Under about 720px the section list becomes a horizontal strip, the editor stacks full width, Safety Exit / Redact stay pinned, and login fields use a 16px font so iOS does not zoom the page. Open, type, autosave, Lock, and Safety Exit work on current mobile Chrome, Safari, and Firefox. A larger screen is still easier for long case notes.

Safety Exit immediately wipes the in-memory session (passphrase, keys, decrypted content) and forces a clean reload of the page. Use it if you need to clear the vault quickly — for example if someone approaches, or if you are leaving a shared computer. It is available as a persistent button and via the keyboard shortcut Ctrl+Shift+X.

While the vault is open, choose Destroy. You will be asked to type an exact confirmation phrase. The server also verifies write authorization before deletion. Once destroyed, the data cannot be recovered. There is no recycle bin and no administrator restore.

The system uses revision numbers. If another session has already saved a newer revision, your save is rejected with a conflict notice rather than overwriting the other person’s work. You can then reload to see the latest content and decide how to proceed.

Navigation is hardened so that using the browser Back button does not resurrect a previously decrypted view. Leaving the page or hiding it also clears sensitive material from the active session where possible.

No. Lock the vault or use Safety Exit before stepping away. The automatic timer helps, but the safest practice is to lock deliberately when you are done or when the environment is no longer private.

Modern browsers that implement the Web Cryptography API (current Chrome, Firefox, Safari, Edge). Very old browsers without Web Crypto support cannot perform the required encryption operations.

Encrypted blobs are stored on the server in a location that is not web-accessible. The application configuration and web-server rules deny direct download of those files. Only the application’s API can read or write them, and even then only as opaque ciphertext.

No. The API is intended solely for the official client interface. It is not designed as a public integration surface.

This build derives keys with PBKDF2-SHA256 at 600,000 iterations. That delay is deliberate so guessing passphrases is expensive. Phones will feel it more than desktops. It is expected, not a hang.

No. Unzip and upload is enough. Leave HV_SALT_MANUAL as an empty string. The first HTTPS visit writes logs/.hv_host_secret automatically. That file is the host salt. Download it later and keep it with backups of vaults/.

You may paste a key if you want one you generated yourself: run openssl rand -hex 32 and put the 64 hex characters into HV_SALT_MANUAL in config.php. That is optional, not required.

Do not change the secret after people have saved cases. Changing it does not decrypt files; it only changes the filename map, so slugs look empty.

The passphrase is chosen by the person opening a case. It never leaves the browser. It encrypts the notes.

The host salt is a server secret used only to turn a slug into a filename and to hash write-tokens. Operators need it to keep finding the same files. They still cannot read the notes without the passphrase.

While a vault is open you can copy the decrypted content or use Print / Save as PDF from the browser. There is no separate “export encrypted package” button in the base interface; the authoritative store remains the server-side ciphertext protected by your passphrase.

No third-party analytics, tracking pixels, or external script hosts are included. The Content-Security-Policy is written to block unexpected network connections. Network activity is limited to the application’s own API.

It is intended for sensitive case documentation — situations where confidentiality matters and where the inability of operators to recover or read content is a deliberate requirement rather than a limitation.

No. It is a focused encrypted notebook / case-file container. It does not replace calendaring, task assignment, reporting dashboards, or multi-user workflow systems. It exists for the material that must remain confidential even from the people who host the infrastructure.

Open the vault immediately (if you still can), copy any content you need to retain, then permanently Destroy the vault. Create a new vault under a new slug and a new strong passphrase. Treat the old passphrase as compromised.

At least 12 characters; longer is better. Prefer a mix of upper and lower case, numbers, and symbols, or a long memorable phrase. Avoid anything derived from the case name, your name, or common passwords. The strength indicator on the home screen gives immediate feedback.

See the Security Design page for a plain-language overview of the architecture and the principles behind it.

Contact the person or team that deployed this instance of Housing Vault. They can speak to local policy, retention expectations, and operational practice. This knowledge base covers the product’s built-in behavior and security model.