Skip to content

How it works

How your vault, sealed sharing and recovery work

Pick a login or API key, seal it in your browser and send a sealed link: an encrypted link that needs a separate access code and opens once, within limits you set. This page covers sending to an agent, what the agent sees and how the vault itself works.

Create a free vault How security works

£0 · Free plan, no card needed · Encrypted in your browser

A shield in front of servers

Sealed sharing

Share a credential with an agent, sealed

Send a single field, such as a password, API key or PIN, to an AI agent or a person, who does not need an Argoned account. Our server stores only encrypted data, and you keep the access code. Included on Free and Pro.
A phone sharing a link

  1. Open the login in your vault

    Sign in, unlock with your vault secret and open the login or key. The Share button appears on sensitive fields: password, secret, PIN, API key, token, passphrase, private key and SSH key fields.

  2. Seal it and set the limit

    Tap Share on the field and choose how long it works: 1 hour, 24 hours, 48 hours or 7 days (default 48 hours). Your browser encrypts it with Argon2id and AES-256-GCM before anything is uploaded.

  3. Send the sealed link. Keep the code separate.

    You get a sealed link and an access code in four groups of four characters. For an AI agent, paste only the link into the chat and type the code yourself when the agent reaches the Argoned page. Manage or cancel sealed links under Session → Shared links.

  4. It opens only where it is used, then closes

    The agent or person opens the link in a browser. Once the access code is typed in, the credential is decrypted in that browser tab. It opens once, then the link stops working.

Keep the link and the code apart. For a person, text the link and read the code out on a call, or send each one by a different route.

AI agents

Sending to an AI agent safely

Five rules keep a shared credential narrow, short-lived and out of the chat history, whichever AI agent you use.

  • Share the narrowest login you can

    Use a sub-account, a read-only role or a restricted API key.

  • Set the shortest time that works

    A sealed link can last 1 hour, 24 hours, 48 hours or 7 days. Pick the shortest that lets the task finish.

  • Keep the access code out of the chat

    Paste only the link. Type the code yourself, or send it by a different route.

  • Change important passwords afterwards

    Once a credential has been used, only a new password takes the access back.

  • Never hand over the master keys

    Do not give any agent your email, bank or password-manager master password.

  • Follow the guide for your agent

    Step-by-step pages for ChatGPT agent, Claude in Chrome, coding agents such as Claude Code and Cursor, and automations.

    Browse the AI agent guides →

Honest limits

What the agent sees

A sealed link protects the credential on the way and while it is stored. Here is where an AI agent can still read it.
An AI agent working on a screen

Where the credential can be read

  • Your chat with the agent

    The chat history holds the sealed link. The password is never in it in plain text.

    Only the link

  • Our servers, while it waits

    We store only the locked form. The access code stays with you.

    Encrypted

  • The Argoned page, once opened

    The credential is decrypted in that browser tab, so a browser agent viewing the page can read it at that moment.

    Whoever sees the page

  • The agent and the company behind it

    What the agent saw may be kept by the agent and by the company that runs it.

    May keep it

Today the credential is opened on the Argoned page the agent is viewing, so a browser agent can read it at that moment. The agent, and the company that runs it, may keep what the agent saw.

It is never in plain text in your chat, your email or on our servers. When you can, open the sealed link yourself and sign in, so the agent never handles the password at all.

Guides for ChatGPT, Claude, coding agents and automations →

Your vault

Your vault, from the first sign-in

Setup happens in your browser: choose a vault secret, let it be strengthened, pick an auto-lock time and keep the keys with you.
  1. 01

    Choose your vault secret

    After a short welcome, you choose a vault secret of at least 8 characters. It is separate from your login password.

  2. 02

    Wait while it is strengthened

    Your browser spends a moment turning the secret into a key with Argon2id. Keep the tab open until it finishes.

  3. 03

    Pick an auto-lock time

    Choose how many idle minutes the vault waits before it locks itself. Mouse, keyboard and touch activity reset the timer.

  4. 04

    Keys stay with you

    Your device creates the vault key and locks it with your secret; only the locked form is uploaded. At the end of setup, your browser sends the vault secret to us once so we can email you a backup copy. We do not store it.

A person unlocking a phone

When you come back

  1. Sign in to your account

    You log in as usual. The app downloads your vault profile: salts, locked keys and settings, never readable passwords.

  2. Enter your vault secret

    Your browser rebuilds the keys and keeps the vault key only in this tab’s memory while you work.

  3. Work in the vault

    Activity keeps the session open until you stop or reach the auto-lock limit.

  4. Lock or log out when you are done

    Locking or logging out clears the vault key from memory.

Items and plans

Private items, on every plan

Every password, API key and note in your vault is encrypted on its own, and the Free plan already includes sealed sharing.

  • Every item has its own lock

    Each password, key or note is encrypted with its own key before it is saved. Opening one item does not open the rest.

  • Private titles

    Titles can be encrypted too, so our server cannot read your list of logins and keys.

  • Never stored unencrypted

    Every item is encrypted in your browser before it is stored. If your vault is locked, you unlock it before anything can be saved.

  • Free plan, with sharing included

    £0 · Free plan, no card needed. A real vault, not a trial, with up to 8 items. Sealed sharing with agents and people is on every plan. Pro is £2.99 a month for 512 items and bulk import.

    Compare Free and Pro →

Recovery

If the vault secret is lost

Recovery is in your hands. There is no hidden reset, so set up recovery material before you need it and keep it where only you can reach it.

  • Recovery phrase

    An optional recovery phrase can open the same vault. Store it somewhere apart from your vault secret.

  • Emergency kit

    Download an emergency kit from Settings → Recovery and keep it offline. It is recovery material, kept separate from your login password.

  • If both are lost

    If you lose both your vault secret and your recovery material, the saved items stay locked. We cannot open them either.

Open source

Read the crypto

Argoned’s code is published under the MIT licence, so you can read exactly how encryption, sealed sharing and recovery work.
Source code on a monitor

MIT · Public mirror

Read how encryption, sealed sharing and recovery work, and how routine sync works without your plaintext. The public code is a mirror of the managed service. You can also host your own copy.

Not independently audited yet. Anyone can read the code and report what they find.

narwalsandeep/argoned-vault

View the code

In development

The Argoned Agent Connector

The Agent Connector is a small helper for your computer, in development, that will open a sealed credential and fill it in for your agent, so the agent does not read it. It is not available yet and has no release date.
A person beside a vault door

Your agent needs a login. Send it sealed.

Create a free vault How security works

£0 · Free plan, no card needed · Encrypted in your browser