StretchVault FAQ

This FAQ collects the questions teams ask most often. For error-specific fixes, see also Troubleshooting Common StretchVault Errors.

Getting started

What is StretchVault? It's the StretchSuite secrets manager — an encrypted, governed place to store passwords, secure notes, server logins, API keys, and payment cards for your whole organization.

Do I need to install anything? No. StretchVault runs in your StretchSuite workspace in the browser.

What's the difference between a vault and an item? A vault is a container that groups related items; an item is a single stored record (like one login), and every item lives in exactly one vault.

What item types are there? Login, Secure note, Server, API key, and Payment card. Login is the default. See Item Types Explained for details.

Security and privacy

How are my secrets protected? Every secret is encrypted with AES-256-GCM before it's stored. Secret values never appear in list views, dashboards, or reports — only metadata does.

Can other people see my passwords? Only if they can reveal the item. Owners and admins can reveal within the vaults they administer; everyone else needs a per-item grant at reveal scope. Every reveal is logged.

How does StretchVault know a password is reused without seeing all my passwords? It compares one-way fingerprints (SHA-256 hashes), never the plaintext. Identical secrets produce identical fingerprints, so reuse is detectable without assembling your actual passwords.

Is my password sent to an outside breach service? No. Breach matching uses a bundled list and local fingerprints; your plaintext never leaves the secure boundary for these checks.

What happens if encryption isn't configured? StretchVault refuses to store new secrets rather than save them unprotected — a deliberate fail-safe. Existing ciphertext stays encrypted.

Everyday use

How do I see a stored password? Open the item and choose Reveal. That decrypts the single secret and logs the action.

How do I change a secret without losing the old details? Edit the item and type the new value in the secret field. If you leave the secret field blank, the existing secret is kept unchanged.

How do I create a strong password? Use the Generator tab — pick a password (8–128 characters) or passphrase (3–12 words) and copy it into your item.

How do I organize a large vault? Use folders for hierarchy (like a folder per client) and tags for cross-cutting labels (like billing or retire-soon).

What's the safest way to give someone a password? Share the item with a grant at reveal scope rather than sending the password. Grants are per item, can expire, and can be revoked, and every use is logged.

What do the sharing scopes mean? View = see metadata only; Reveal = see metadata and reveal the secret; Edit = view, reveal, and change the item.

How do I remove someone's access? Open the Sharing tab, find the grant, and revoke it. You can also set an expiry so access ends automatically.

Security review

What's the difference between Watchtower and Breach-watch? Watchtower is the thorough, weighted, saved review with a security score and recommendations. Breach-watch is a fast exposure scan for quick triage. Use Breach-watch for a glance and Watchtower for periodic, on-the-record reviews.

What does the security score mean? It's a 0–100 rating of a vault's credential health, reduced by exposed, reused, weak, old, and no-2FA items. Watchtower labels it excellent (90+), good (70+), fair (50+), or at risk (below 50).

What is rotation? Regularly changing credentials, and immediately changing any that are exposed. The rotation plan prioritizes which to change — critical (exposed), high (reused/weak), medium (old), low.

Tips

Turn on the 2FA flag wherever it's true; it directly improves your security score and clears the easiest findings.
Prefer grants over forwarding so every use of a secret stays accountable.
Save your Watchtower runs to build an audit trail you can show clients and auditors.
Rotate anything that ever lived in a shared document — treat it as already exposed.