Store more than passwords.

Use purpose-built item types, extend Logins with passkeys and Authenticator, and run saved SSH commands on desktop.

Understand items and fields

Each vault contains a flat list of items. An item type supplies its default fields, while custom fields let you extend an item without creating a new type. Concealed fields are kept outside the searchable index and decrypted only when requested.

Login extensions are different from item types. Authenticator and passkeys belong to a Login and synchronize with it. They do not appear as separate vault items.

Choose an item type

9Secure includes Login, Payment Card, Bank Account, Address, Identity / Passport, Software License, WiFi Network, Crypto Wallet, API Credential, SSH Key, Secure Note, File, and Custom.

• Choose Login for usernames, passwords, websites, passkeys, and Authenticator setup.
• Choose SSH Key for a public key, concealed private key, concealed passphrase, notes, and reusable commands.
• Choose Custom to define your own labeled fields when no built-in schema fits.

Files and attachments

Items make 9Secure a structured personal information vault, not just password storage. Fields and attachment slots are suited to each item's purpose:

Attachments are encrypted inside the vault. There is no artificial per-file size cap or hosted storage quota. Practical limits depend on available device storage, filesystem capabilities, and performance. Larger files take longer to encrypt, decrypt, and synchronize.

On desktop, decrypting a File item's attachments creates a plaintext scratch folder. You can edit or rename files or add files there, then use Encrypt to save the changes back into the vault. This is a temporary working copy, not a folder hierarchy inside the vault.

Decrypted files are ordinary plaintext. They may remain after interrupted sessions or failed cleanup. External apps and the operating system may retain thumbnails, recent-file entries, caches, or temporary copies. Re-encrypting the item does not guarantee removal of those traces.

Find previous values in Log

Open Log from the main app navigation on Windows, macOS, iOS, or Android. It shows retained changes across your vaults, including item edits, removed fields, and attachment events.

1. Select the relevant vault, or leave all vaults selected.
2. Use the filter and date sort to find the item and change you need.
3. Look for Previous on a changed field, or the recorded value on a removed field. Values appear only when retained in that event.
4. Use the value's reveal or copy control. Concealed values stay masked until you reveal them.
5. To reuse old text, edit the item, paste the value into the appropriate field, and save. Recreate a removed field or item manually if needed.

In Settings, Automatically compact history controls automatic trimming of older events. It is enabled by default. Log retention count defaults to 500 events per vault on Windows and macOS, and 100 on iOS, iPadOS, and Android. Increase the count or turn automatic trimming off to retain more history on that device; this does not recover events already removed.

Log is read-only, not an undo system. It cannot restore an item or vault to an earlier point in time. Attachment events describe changes but do not let you open or recover deleted file contents. Copying an old secret also exposes it to the clipboard. History retention is separate from storage compaction.

Add Authenticator to a Login

1. Create or edit a Login.
2. Select Add Authenticator.
3. Scan the service's setup QR code, import a QR image using the options below, or enter a Base32 secret or otpauth://totp URI manually.
4. Select Create or Save. Scanning and image import fill the editor but do not save the Login.
5. Open the Login to copy the rotating code and complete the service's two-factor setup. Windows and macOS can also deliver the code through Vaultlight.

Manual Base32 secrets use SHA-1, six digits, and a 30-second period. TOTP URIs can specify SHA-1, SHA-256, or SHA-512, six or eight digits, and a period from 1 through 300 seconds. HOTP is not supported.

Authenticator is supported in the Windows, macOS, iOS, and Android apps. The setup value is one concealed TOTP field on the Login. Codes are generated locally on demand and require an accurate device clock.

Scan a QR code or import a screenshot

Use the camera or image button beside the Authenticator setup field when creating or editing a Login. These controls also work when replacing an existing setup.

• iOS: use the camera button to scan a setup QR code and allow camera access when prompted. For a screenshot already on your device, use the image button, then choose from Photos, Files, or Paste. On iPad, you can also drop an image into the import sheet.
• Android: use the camera button to scan a setup QR code and allow camera access when prompted. The image button opens Choose from Photos, Choose from Files, and Paste. You can also drop a single image into the import dialog. Image paste requires a source app that puts an accessible image or image-file URI on the clipboard, not text.
• macOS: use the image button, then Choose Image, Paste or Command+V, or drop an image or copied image file into the import sheet. There is no camera scanner or separate Photos picker.
• Windows: use the image button, then Choose Image, Paste or Ctrl+V, or drop an image or copied image file into the import dialog. There is no camera scanner or separate Photos picker.

If camera access is denied or no camera is available, import an image or enter the setup secret manually. You can change camera permission in the device's system settings.

QR recognition runs on your device. 9Secure does not save or upload the scanned frames or imported image, and it reads the clipboard only when you paste. A selected cloud photo or file may still need to be downloaded by its system provider.

Troubleshoot Authenticator import

• Use the service's individual otpauth://totp setup QR code. HOTP codes, authenticator migration/export QR codes, unrelated links, and QR codes containing only a raw Base32 secret are not supported. Enter a raw Base32 secret manually instead.
• If more than one distinct setup is found, crop the image to one QR code and try again.
• Try a clear PNG or JPEG with the full QR code visible. Other image formats depend on the operating system's decoder. Images must be no larger than 20 MiB and 100 megapixels; crop or resize larger files. Only the first frame of an animated image is read.
• If image paste fails, copy the image itself rather than its web address, or use the file or photo picker.
• Save the Login after import. Cancelling the editor leaves the saved Login unchanged.
• If the service rejects a saved code, check the device clock and confirm you imported the setup for the correct account.

A setup QR code contains the Authenticator secret. Protect screenshots and clipboard copies like passwords. Remove unneeded copies after setup, including copies in cloud photos, backups, or clipboard history where possible.

Enable and use passkeys

Passkeys are supported in the Windows, macOS, iOS, and Android apps where the operating system exposes a compatible credential-provider API. A passkey is an independently protected concealed credential attached to a Login, not a new item type or a normal custom field.

• Windows: use the passkey onboarding screen or Settings to register 9Secure, then enable it under Settings > Accounts > Passkeys > Advanced options. System integration requires Windows 11 24H2 build 26100.6725, Windows 11 25H2 build 26200.6725, or later. Windows 10 does not provide the required provider API.
• macOS and iOS: enable 9Secure under Password AutoFill. Passkey AutoFill requires macOS 14 or iOS 17 or later.
• Android: open Android's passwords and passkeys settings and enable 9Secure. Passkey provider support requires Android 14 or later and a device that exposes the credential-provider settings.

1. Start passkey creation from a supported website or app.
2. Choose 9Secure as the passkey provider.
3. Unlock the keyring if requested.
4. Choose an existing Login without a passkey. Create the Login in 9Secure first if no suitable Login exists.
5. Use the same provider flow when the website or app later asks you to sign in with the passkey.

Open the Login in 9Secure to review or remove its passkey. Passkeys synchronize with their Login between Windows, macOS, iOS, and Android. Sync the containing vault, then enable 9Secure as a passkey provider on the receiving device. The same passkey can sign in there when the device meets the platform requirements above.

A successfully received passkey is marked backed up only after authenticated Sync commits it durably.

Know the passkey boundaries

9Secure stores ES256 passkey key material and account metadata inside a versioned concealed credential. The private key is never exposed through ordinary fields or generic plaintext vault export. Passkey imports from browser or password-manager exports are not supported.

The operating system and native credential-provider extension own browser or app integration, request transport, user verification, and interface. 9Core validates the WebAuthn ceremony data and performs credential operations. A compromised unlocked device or malicious provider path can still misuse credentials that the user authorizes.

Create an SSH Key item

1. Select New Item, then choose SSH Key.
2. Enter the public key, private key, passphrase, and notes you need.
3. Select Add Command for each reusable command, then give it a short title and the complete command text.
4. Save the item.

The private key and passphrase are concealed. Command titles and command text are ordinary text fields, so they are part of the decrypted searchable index while the vault is unlocked. Commands and key fields synchronize with the SSH Key item.

Run SSH commands on desktop

Windows and macOS can run a saved command from the SSH Key item or from its Vaultlight action. Select the play action beside the command. Mobile apps can store, view, edit, and synchronize SSH Key commands but do not execute them.

On macOS, 9Secure runs the complete text through zsh. On Windows, it runs through cmd.exe. The process starts in your home folder, and the saved passphrase is supplied through a temporary SSH askpass helper when an SSH client requests it. The stored private-key field is not installed, written to ~/.ssh, or added to an SSH agent automatically.

Load a key into your SSH agent

Use a saved command to unlock a local SSH key and add it to your running agent. Git and later SSH connections can then reuse that key without asking you to type its passphrase again. 9Secure supplies the saved passphrase; OpenSSH loads the key file into the agent.

1. Place the matching private key in a protected local file and register its public key with GitHub or your server. Configure SSH to select that key, or add -i and its file path to the command. Keep the passphrase in the item's concealed Passphrase field, never in command text.
2. Prepare the local agent:
   • macOS: use the system OpenSSH client and an agent reachable by 9Secure. An agent started only inside a terminal may not be available to the app.
   • Windows: install the Windows OpenSSH Client and enable its ssh-agent service. In an administrator PowerShell, run Set-Service ssh-agent -StartupType Automatic, then Start-Service ssh-agent. Run 9Secure normally, not as administrator. In Command Prompt, use where ssh to check that ssh resolves to Windows OpenSSH rather than Git for Windows' bundled client.
3. Test the connection in a terminal first and verify the server's host-key fingerprint through a trusted source. The saved command cannot interactively approve an unknown host.
4. Select Add Command and name it macOS Agent or Windows Agent. For GitHub, both OpenSSH clients use ssh -o AddKeysToAgent=yes -T [email protected]. This authenticates to GitHub and asks SSH to add the local key it loads to the agent. GitHub's successful-authentication message says it does not provide shell access; that is expected.
5. For another machine, use ssh -o AddKeysToAgent=yes -T your-host exit. Replace your-host with your configured SSH host alias or user@hostname. This authenticates, loads the key into the local agent, and exits without opening an interactive shell.
6. Save and select the command's play action in the app. Alternatively, open Vaultlight, select the SSH Key item, and press the Control plus number shortcut displayed beside the command. Its number depends on the item's actions.
7. Use ssh-add -l from the same OpenSSH installation and agent to verify that the key is loaded. Git operations against SSH repository URLs can reuse it while it remains available in that agent.

Commands synchronize, but SSH clients, local key files, agents, and trusted-host configuration do not. Keep separate macOS Agent and Windows Agent commands when paths or configuration differ, and run the one for your current desktop.

On Windows, Git must use the same OpenSSH client and agent. Git for Windows' bundled SSH may use a different agent and still ask for a passphrase. See GitHub's Windows agent configuration if needed.

Locking 9Secure does not unload keys from an external SSH agent. Manage key lifetimes and removal with your SSH tools. Use a terminal for interactive work or full command output.

A saved command is executable shell input. Review it before running. Shell operators, scripts, and non-SSH programs are not blocked. Never run a command received from an untrusted vault or device. 9Secure captures limited output for status reporting, but successful execution does not prove that the intended remote action completed.