Vault Lock is an optional setting in the AliasFleet browser extension that encrypts stored session tokens on the local device with a 4-digit PIN. This page explains how Vault Lock works, how to enable it, how to unlock and manually lock the vault, and how to recover access after repeated wrong PIN entries.
Vault Lock is controlled from inside the AliasFleet browser extension. Install the extension and sign in before turning Vault Lock on. Installation and sign-in are covered in Using the Browser Extension.
How does Vault Lock protect session tokens?#
A signed-in extension stores access and refresh keys in local storage on the device. Extensions run in a browser sandbox, yet stored files on the device remain readable to malware on the computer or to a person with physical access to an unlocked device.
Vault Lock encrypts those session tokens with AES-GCM 256-bit encryption. The encryption key is derived on the local device from the chosen 4-digit PIN and a random local salt, using the PBKDF2 key derivation algorithm. The PIN is never sent to AliasFleet servers and is never stored on them. Both encryption and key derivation take place entirely on the local device.
Vault Lock applies only to the session tokens stored by the extension. It does not alter how aliases forward mail, and it does not replace the account password, which remains required for sign-in.
How do I enable Vault Lock?#
Vault Lock can be configured during the first sign-in to the extension, or switched on later from Settings. To enable it from Settings:
- Open the extension and select the Settings tab.
- Find the Security section within Settings.
- Switch on Vault Lock by toggling the Vault Lock option.
- Set a 4-digit PIN and confirm it when prompted.
- Click Enable Vault Lock to complete setup.
After setup, the vault remains unlocked while the browser stays open and the session stays active.
When does the vault lock?#
Locking removes the decrypted key from memory. The vault locks in three cases:
| Lock trigger | Result |
|---|---|
| Browser restart | Closing and reopening the browser locks the vault. |
| 15 minutes of inactivity | More than 15 minutes without activity locks the vault. |
| Manual lock | Selecting Lock Vault in the settings menu locks the vault at once. |
While locked, the vault blocks access to the stored session tokens until the correct PIN is entered.
How do I unlock the vault?#
- Click the extension icon in the browser toolbar.
- Enter the 4-digit PIN at the prompt.
- Wait for the vault to unlock and restore extension access.
The key is held in temporary browser session memory, so the PIN is entered once per browser session. The vault locks again on browser restart, after 15 minutes of inactivity, or after a manual lock.
How do I lock the vault manually?#
- Open the extension and select the Settings tab.
- Click Lock Vault in the settings menu.
Manual locking is the immediate option before leaving a device unattended, rather than waiting for inactivity or a browser restart.
How do I verify Vault Lock is working?#
- Enable Vault Lock using the steps above.
- Click Lock Vault in the settings menu.
- Click the extension icon and check that a PIN is requested before access returns.
- Enter the 4-digit PIN and check that the extension opens normally.
If the extension opens without requesting a PIN after a manual lock, repeat the manual lock step and confirm that Vault Lock is switched on in the Security section of Settings.
What happens after repeated wrong PIN entries?#
Five incorrect PIN entries in a row trigger a logout. The extension deletes all local session tokens, including the encrypted token cache. Recovery is a standard sign-in:
- Sign in again to the AliasFleet account with the account password.
- Set up Vault Lock again from Settings if the feature is still required, choosing a new 4-digit PIN.
The count covers consecutive incorrect entries. A correct PIN entry restores access without a logout, after which the normal lock rules for restart, inactivity, and manual locking apply.
Troubleshooting#
The vault is locked after reopening the browser.
This is expected. A browser restart locks the vault. Click the extension icon and enter the 4-digit PIN to unlock it.
The vault locked while the browser was still open.
More than 15 minutes of inactivity locks the vault, as does a manual lock from the settings menu. Enter the PIN to restore access. An ordinary lock does not require a fresh sign-in.
The PIN is rejected repeatedly.
Enter the PIN carefully and check each digit before submitting, because 5 incorrect entries in a row delete local session tokens and log the extension out. If a logout has already occurred, sign in again with the account password and set up Vault Lock again from Settings.
The PIN cannot be found on the account.
The PIN is never sent to AliasFleet servers, so it is not held in the account and cannot be retrieved from an account page. If the PIN is lost and the vault is locked, recovery follows the lockout path: after 5 incorrect entries the extension logs out, and a normal password sign-in restores access.
Related guides#
- Using the Browser Extension: install the extension, sign in, and create aliases from signup forms.
- Security Best Practices: the wider account security setup, including password habits alongside Vault Lock.