Creating Vaults and Adding Items

Vaults are the containers that hold your secrets, and items are the individual records inside them. This guide walks through creating a vault and adding each kind of item.

Creating a vault

1. Open StretchVault and select the Vaults tab.
2. Click New vault.
3. Give the vault a clear, descriptive name — for example Shared Ops, Marketing SaaS, or Acme Corp (Client). The name is the one required field.
4. Save. The vault appears in your list immediately and is ready to hold items.

Think of a vault as a boundary for access. Items you'd share with your whole team belong in a different vault than items only two admins should ever touch. You can create as many vaults as you need.

Adding an item

Every item starts the same way:

1. Click New vault item (top of the left rail) or open a vault and choose Add item.
2. Pick the vault the item belongs to.
3. Choose an item type (see below).
4. Enter a title — this is required and is how you'll recognize the item in lists.
5. Fill in the fields for that type, including the secret value.
6. Optionally add a folder, tags, notes, and set the 2FA flag if the account has two-factor enabled.
7. Save.

When you save, StretchVault encrypts the secret with AES-256-GCM before storing it and — if the security engine is enabled — immediately analyzes its strength and checks it against common-breach lists. If the secret matches a known breached password, the item is marked exposed automatically.

Item types

Choose the type that best matches what you're storing. The type controls which fields make sense and how the item is grouped.

• Login — a username/password pair for a website or app. Fill in username, URL, and the password as the secret. This is the default type.
• Secure note — freeform confidential text, such as a recovery phrase, a Wi-Fi password, or internal instructions. Put the sensitive content in the secret/notes fields.
• Server — an infrastructure credential such as an SSH login or database account. Use the username, URL/host, and secret fields; add connection details in notes.
• API key — a token or key for a service integration. Store the key as the secret and use the title to say which service and environment it belongs to.
• Payment card — a card you need to reuse for company purchases. Store the number as the secret and use notes for expiry and billing details.

A realistic example

Meridian Studio sets up their Marketing SaaS vault:

1. They add a Login for their email platform: title Mailchimp — Meridian, username ops@meridian.studio, URL login.mailchimp.com, and paste the password.
2. They add an API key for their analytics tool: title Plausible API — Production, with the token as the secret.
3. They add a Secure note titled Office Wi-Fi with the network name and passphrase.
4. For the email login they set the 2FA flag because they use an authenticator app.

A week later they run Watchtower on that vault and see the API key is aging and one login is weak — exactly the visibility a spreadsheet never gave them.

Editing and deleting items

• To change details, open the item, edit any field, and save. If you leave the secret field blank, the existing secret is kept unchanged — you only replace it when you type a new value.
• To remove an item, open it and choose Delete. Deleted items are removed from your lists.

Tips

• Use a naming convention like Service — Account/Environment (for example Stripe — Live) so items sort predictably and are easy to search.
• Only type into the secret field when you actually want to set or change the secret; leaving it blank on an edit preserves what's already stored.
• Add the real URL to Login items — it improves strength analysis and helps teammates land on the right sign-in page.
• Set the 2FA flag honestly. It directly affects your Watchtower score and rotation plan.

Troubleshooting

"A vault name is required." The vault name field was empty — enter a name and save again.

"An item title is required." Every item needs a title, even a Secure note. Add one before saving.

"StretchVault encryption is not configured." The vault can't encrypt your secret because no master encryption key is set up. Check the Health tab; if encryption shows as disabled, contact your workspace administrator. You can still save items without a secret value in the meantime.