To protect your inbox and keep your email aliases secure, the AliasFleet browser extension supports Vault Lock—an optional client-side security feature that encrypts your session tokens on your local device.
Why use Vault Lock?
When you log in to the extension, your access and refresh keys are saved in local storage. While modern browsers run extensions in a secure sandbox, malware running on your computer or someone with physical access to an unlocked device could potentially read these stored files.
Vault Lock encrypts your session tokens using AES-GCM (256-bit).
The encryption keys are generated entirely on your machine:
- You choose a 4-digit PIN.
- The extension derives an encryption key from your PIN and a random local salt using the PBKDF2 key derivation algorithm.
- Your PIN is never transmitted to, or stored on, AliasFleet's servers.
Setting up Vault Lock
You can set up Vault Lock when you first sign in to the extension, or enable it later through Settings:
- Open the extension and click the Settings tab.
- Scroll to the Security section.
- Toggle the Vault Lock option on.
- Choose a 4-digit PIN, then confirm it.
- Click Enable Vault Lock.
Unlocking your vault
Once enabled, the extension will stay unlocked as long as your browser remains open.
The vault will automatically lock itself (wiping the decrypted key from memory) when:
- You close and restart your browser.
- You are inactive for more than 15 minutes.
- You click Lock Vault manually in the settings menu.
When locked, simply click the extension icon and enter your 4-digit PIN to restore access.
Brute-force protection
If an incorrect PIN is entered 5 times in a row, the extension automatically triggers a logout, destroying the local encrypted token cache. If this happens, you will just need to sign in again to your AliasFleet account.