The vault is the part of Context people fill fastest and think about least. It is a good place to put an API key, a bad place to put “everything sensitive”, and the difference between those two sentences is worth ten minutes of your time.
What the vault actually is
API keys and passwords are stored encrypted, separately from your notes. They stay masked in the list and in the detail view; revealing a value is an action you take, not something the app does for you as you scroll past. The ⌘K palette finds vault records alongside pages and tools. So a secret isn’t hidden from you just because it is hidden from a shoulder.
Two boundaries matter. Optional AI help, if you switch it on, reads notes relevant to your question and names the note it used. Vault records sit outside that scope and are not read unless you open them. And while sync is off, the records exist only on your device.
What earns a place
The test is simple: a short string you need to paste, that would be a problem in someone else’s hands, and that you can replace if it leaks.
- API keys and tokens. The thing the vault was built for. They are short, you paste them often, and rotating one is a five-minute job.
- Database and service passwords for things you administer.
- Recovery and backup codes for accounts whose second factor lives on your phone.
- Licence keys and short secret notes, the “where did I put that” class of string.
What these have in common is that they are replaceable. If a key leaks, you revoke it and issue a new one. That property is what makes a young piece of software an acceptable home for them.
What does not belong
The only copy of anything. This is the general rule for the whole product and it applies hardest here. Version 0.4 is not a stable release and the data format is still moving. If a secret cannot be regenerated, say a recovery phrase or an inherited credential nobody else has, it needs a copy somewhere that is not this workspace.
Credentials you will need on a phone. The web version is live; mobile apps and the browser extension are still in development. A password you need at a checkout, on a train, on a phone, is a password that should be in something already installed on that phone. Putting it here means you have moved it away from where you use it.
Other people’s secrets. A shared team credential in a personal, local, unsynced vault is a single point of failure with only one person standing on it. That is less a limit of Context than the definition of a personal vault.
The things a browser already handles well. The password for a site you log into on one machine, in one browser, is already covered. Moving it here adds a step to every login and adds nothing else.
Why a short vault is a better vault
A vault with four hundred entries is a filing cabinet, and nobody audits a filing cabinet. A vault with twenty entries is a list you can read down in a minute and ask, for each line: is this still live? did I rotate it? should this even exist any more?
That review is the actual security benefit, and it is the first thing you lose by putting everything in. Keep the vault to the secrets that would cost you a bad afternoon, and let the rest live where it already lives.
The limits, without softening
These are the same three that appear on the security page, and they belong in this decision:
- Version 0.4 is not a stable release; the data format is still moving.
- There is no independent security audit. The scope and auditor agreement are drafted; there is no report.
- End-to-end encryption is not complete for every scenario.
None of that makes the vault useless. It makes it appropriate for replaceable secrets and inappropriate as the last copy of an irreplaceable one. That is a narrower claim than most tools make, and it is the one we can actually stand behind today.
A ten-minute starting set
- Put in the three or four API keys you actually paste in a given month.
- Add the admin passwords for the services you are responsible for.
- Add recovery codes only if their account’s second factor is somewhere else. Otherwise you have put the lock and the key in the same drawer.
- Stop. Leave the rest where it is for a fortnight and see what you actually reached for.
- Export to Markdown once and keep the export off this machine. The vault backup can be exported separately; the nightly snapshot lives on the same device it protects, which doesn’t amount to a backup strategy on its own.
Point five is the one people skip, and it is the one that matters. The most secure vault in the world is still a vault on a laptop that can be dropped down a stairwell.