Encrypted SSH vault and recovery

The SSH vault is optional and available on Plus, Pro, and Elite. It keeps saved hosts, portable private keys, and command snippets consistent across your signed-in devices.

Your device creates a random vault key and encrypts the whole snapshot before upload. Your vault password protects that key locally. The recovery code can reset a forgotten password. tokenstat.ai stores only ciphertext, revision metadata, salts, and opaque encrypted key material. It cannot read a hostname, password, private key, or snippet.

Create or restore

In SSH on the first device, choose Create vault and set a vault password. tokenstat then shows a one-line recovery code once. Store it in a password manager or on paper, then confirm with I have saved this before closing the screen.

Unlock the same account vault on another signed-in device with its password. If you forget the password, choose Forgot password?, enter the recovery code, and choose a new password. Neither the password nor the recovery code is uploaded in usable form.

The recovery limit is deliberate

The recovery code is the password-reset path. There is no operator-recovery path. If every device able to open the vault, the password, and the recovery code are lost, the vault is permanently inaccessible. Support cannot override this boundary because tokenstat never has a decryption key.

An unlocked device can issue a new recovery code. The former code stops working after the encrypted rotation is accepted.

After a plan downgrade, new synchronized changes pause, but downloading, restoring, exporting, or deleting an existing encrypted vault remains available.