Frequently Asked Questions

The questions that come up most, answered plainly. Where the answer is "no", it is because of how StarVault is built rather than an oversight — and it is better to say so than to imply a safety net that is not there.

Is my vault sent anywhere?

No. StarVault makes no network connection of its own. There is no telemetry, no update check, no account, and no sync server. It runs with the network cable out.

The one thing that can talk to the outside world is the browser extension, and only to 127.0.0.1 — your own machine — on port 8088. The extension asks the running StarVault for an entry to fill; it never talks to a server, and there is no server to talk to.

There is one deliberate exception, and it is off unless you turn it on. The Vault Health advisor can consult a remote AI provider — OpenAI, Anthropic, Gemini, OpenRouter, DeepInfra or Fireworks — to write a second opinion on your vault's security. That needs an API key you supply, and until you supply one the advisor uses its built-in local engine, which runs offline on your machine. If you do configure a remote provider, the findings it sends are the audit results, not your passwords.

What happens if I forget my master password?

The vault cannot be opened. There is no reset, no recovery code, no backdoor, and no way for anyone — including whoever wrote StarVault — to decrypt it without the password.

That is the direct consequence of the vault being zero-knowledge: the key is derived from your password and exists only in memory while the vault is unlocked. Nothing on disk can be used to reconstruct it.

If the vault is in two-factor mode, the same applies to the keyfile: losing the QR sheet without a copy means the vault is unopenable even with the right password.

Write the password down and keep the keyfile somewhere safe. A password manager you already trust is a fine place for the master password — it is one password, and the risk of losing it is far more immediate than the risk of it leaking.

Where are my entries actually stored?

In one SQLite file, by default at %LOCALAPPDATA%\StarVault\starvault.db.

Entries, groups, tags, version history and attached files are all inside it. Copying that file is a complete backup; deleting it is a complete erasure. There is no second location and no cache to clear.

Can I use it on more than one computer?

Yes, by carrying the vault file — but read this first.

Copy starvault.db to the other machine's StarVault folder and it opens there with the same master password. What StarVault does not do is merge two copies. If both machines edit the vault and you copy one over the other, the version you overwrote is gone (the version history of individual entries survives, but entries that existed only in the overwritten copy do not).

Two workable patterns:

One machine at a time. Keep the vault on a USB stick or in a synced folder and make sure only one StarVault has it open. Simple, and safe as long as you are not careless about which copy is current.
One machine owns the vault. Keep it on your main machine and use the browser extension or the MCP server to reach it from elsewhere. Nothing to merge because there is only ever one copy.

Pointing the backup folder at Dropbox or Google Drive is a good way to get the file to the second machine. Just remember the copy there is a mirror, not a merge.

Is the exported CSV encrypted?

Only if you set an archive password. A CSV exported with no password is a plain spreadsheet of your entries, readable by anything.

Export to a temporary folder, do what you needed to do, and delete the file. If you need the export to sit somewhere for a while, set a password on the archive — and remember that password, because there is no way back into that archive either.

Why does the clipboard clear itself?

Because a copied password is readable by every other program on the machine, and stays in the clipboard history of most of them long after you have pasted it.

StarVault clears anything it copied after the interval in Settings — 30 seconds by default. If you paste quickly, you will never notice it. If you are slower than the timer, the password is gone from the clipboard and you copy it again. That is the intended trade.

The status bar shows a countdown while a clear is pending, so it is never a surprise.

Does the browser extension need the app running?

Yes. The extension is a thin client: it asks the running StarVault for an entry, and StarVault does the unlocking and decrypting. With the app closed, the extension has nothing to talk to and will say so.

That is deliberate. It means the extension holds no keys and stores no passwords, so compromising the browser profile does not expose the vault.

What is the MCP server for?

It lets an AI assistant — Claude, or anything else that speaks the Model Context Protocol — read and write your vault through a defined set of tools, rather than being handed a password in a chat message.

It runs over stdio, which means it is started by the assistant as a subprocess and talks to it directly; nothing listens on a port. It still requires the master password to unlock, and it can only reach a vault you have explicitly pointed it at.

If you do not use an AI assistant that speaks MCP, you can ignore this entirely — it is off unless something starts it.

Can I use my own fonts or icons?

The font pickers list only the open-source faces that ship with StarVault. There is no "browse for a font file" option.

That is a licensing decision rather than a technical one. Every font and every icon in StarVault is under a licence that permits redistribution — the fonts under the SIL Open Font License and the icons under ISC — so the whole program can be given away or bundled without a legal question. Letting arbitrary system fonts in would break that guarantee.

Something looks wrong. Where do I report it?

Use the Bugs page on this site. Reports go into a tracker rather than an inbox, so nothing gets lost, and you can see what has already been reported.

It helps enormously if you include the version — the title bar shows it — and what you did just before the problem appeared.

Installing StarVault — set it up from scratch
Cryptographic Specifications — the exact algorithms
Keyboard Shortcuts — every key