An OpenVireo account keeps your vaults in sync between OpenVireo on your computers and OpenVireo Web in your browser, and lets you share vaults with other people and with your organization. Everything is encrypted on your devices, with your master password and a Secret Key that only you have. The account server and the sync server only ever store encrypted vaults and keys sealed to their members, so they can’t read your passwords. An account is optional: OpenVireo works without one exactly as it always has.
Ways to Use OpenVireo
The first time you start OpenVireo, the start screen offers three ways to use it:
Your choice is remembered, so later launches skip the start screen; Account → Sign In or Create Account… brings it back.
| Choice | What it does |
|---|---|
Sign in / Create account | Your vaults live in your OpenVireo account and open with your account’s master password. They sync automatically and can be shared. |
Use my own sync server | Your databases sync with an OpenVireo Sync Server you run yourself. Enter the server’s URL and a pairing code from another of your devices or from the server’s admin; new databases are then set up to sync with that server. Each database keeps its own master password. See OpenVireo Sync Server. |
Use without an account | Database files on your computer, with their own master passwords. Nothing leaves your computer unless you set up a sync yourself. |
Creating an Account
On the start screen, click Create account.
Enter your email address and choose a master password. Nobody can reset your master password, not even the server’s operators, so choose one you will remember. Click Change server only if you use an OpenVireo account server other than the default one.
OpenVireo creates your Secret Key on this computer and shows it once. Click Save Emergency Kit… to save or print the Emergency Kit, a PDF with your email, the server, your Secret Key, and a space to write down your master password, and keep it somewhere safe.
Confirm that you saved the Emergency Kit to finish.
Signing In
On the start screen, enter your email and master password and click Sign in. The first time on a device, also click First time on this device? Enter your Secret Key and enter the Secret Key from your Emergency Kit; afterwards the device keeps it. If you turned on two-step verification, enter the 6-digit code from your authenticator app.
Once you are signed in, your account’s vaults all open at once, with no password of their own. They are listed in the database picker under Personal and under the name of each organization you belong to, and the account button at the far right of the header shows who is signed in.
Locking and Quick Unlock
Locking a vault, or Account → Lock Account, locks the account and closes all of its vaults. Account → Unlock Account… asks for your master password and opens them again.
When Quick Unlock is available (Touch ID on macOS, Windows Hello on Windows, or your system password through Polkit on Linux) and turned on under Tools → Settings → Security, Account → Quick Unlock Account unlocks the account without typing the master password. The keys it needs stay in memory only: they are dropped when you sign out or quit OpenVireo.
Vaults
Account → New Vault… creates a vault. It can belong to you or to an organization you manage; a vault of an organization opens for all of its owners and admins, and you can share it with other members afterwards.
Vaults sync automatically, the same way as with a sync server (see Automatic Sync and Conflicts): after each save, when changes arrive from your other devices, and when you come back online.
Moving a Database to Your Account
To bring an existing database into your account, open and unlock it, then select Account → Move Database to Account… and enter a name for the vault. A copy of the database becomes a personal vault, encrypted with a new vault key instead of its master password, and syncs with your account from then on. The database file itself isn’t changed.
Sharing a Vault
Select a vault, then Account → Share Vault…:
Enter the email address of the person to share with and click Look up.
Check their fingerprint with them, for example over the phone: they see the same fingerprint in their own app. Only share when it matches.
Choose their access and click Share:
Read only – they can open the vault and copy from it.
Can edit – they can also change its entries.
Can manage – they can also share it with others and remove members.
To change someone’s access select them and click Change. Removing a member gives the vault a new key, sealed only to the remaining members, so that what the removed member kept can’t open the vault’s future versions.
Organizations
Account → Organizations, Service Accounts and Audit Log… opens the organization settings. Click New organization… to create one; you become its owner. For each organization you can manage:
Members – Invite people by email with the role Owner, Admin, or Member. The invitation is valid for 7 days; they accept it with Account → Accept Invitation… by pasting the link or code from the email. An owner or admin then checks their fingerprint and clicks Confirm… to choose the vaults they can open. Owners and admins get every vault of the organization. You can also change a member’s role, remove them (their vaults get new keys), or select yourself and click Leave… to leave the organization.
Service accounts – Accounts for a CI job, a server, or a Kubernetes cluster rather than a person. Give a service account access to vaults (Read only or Can edit), then click Issue secret… to create a token for it. The token is shown only once: copy it to where it will be used, for example as a CI secret. Each secret can expire on a date, which you can change later with Change expiry…, and can be revoked at any time.
Audit log – Who did what and when in the organization, such as sign-ins, shares, and member and service-account changes.
Service account tokens are used by the openvireo command line tool, which reads secrets from vaults with references such as openvireo read ov://Production/Database/password or runs a command with secrets in its environment (openvireo run --env-file .env — <command>), by openvireo connect, a REST server for other programs and Kubernetes, and by the GitHub Action.
Managing Your Account
Account → Manage Account… opens your account page in OpenVireo Web in your browser; sign in there if it asks. There you can change your email or master password, turn two-step verification on or off, see your devices and sign them out, and download your Emergency Kit again. Changes made there reach OpenVireo on your other devices automatically.
Account → Sign Out signs this device out of your account and closes its vaults. Databases on your computer stay usable.
The User Guide guide covers OpenVireo, based on KeePassXC 2.8.0, last updated 23 October 2026. Found a mistake? Help improve the docs on GitHub.