Vault keys
The ways to unlock a vault, and why you should always have more than one.
A vault key opens the encrypted vault. It is not the same as the passkey you sign in with: signing in proves who you are, a vault key decrypts what you own. Someone who gets into your account still cannot read the vault without one.
The kinds of key
| Kind | What it is | Where it works |
|---|---|---|
| BlockWill Secret | A 16-character passphrase you choose | Any device |
| Touch ID / Face ID | Your device's built-in biometrics, such as Touch ID, Face ID, or Windows Hello | That device only |
| Vault Hardware Passkey | A physical security key such as a YubiKey | Anywhere you can plug it in |
| Vault Phone Passkey | Your phone, paired by scanning a QR code | Anywhere, with the phone |
Your first vault is created with a BlockWill Secret, because it is the only method that works before you have registered anything else. The other kinds are added afterwards.
Adding a key
Unlock the vault, then click Manage.
Under Security methods, click Add method and choose the kind of key in Add Security Method.
Enter a Vault Key Label you will recognise later, like "MacBook Touch ID", and click Add Vault Key. You will be looking at this list in a year trying to remember which key is which.
In Quick security check, enter your passphrase and click Authenticate. BlockWill needs to open the vault before it can hand a copy of the key to the new method. The new key then appears in the list.
Unlocking a vault opens a dialog titled "(vault name) is sealed." Pick a security method and click Unlock vault. That is expected.
Seeing your options
Unlocking a vault opens a dialog titled "(vault name) is sealed." where you pick which key to use, then click Unlock vault. A passphrase and a biometric key are equal citizens here: either opens the vault.
Adding a BlockWill Secret to an existing vault
Choose BlockWill Secret, confirm in Quick security check, name it, click Continue, then set and confirm a passphrase of at least 16 characters and click Add BlockWill Secret.
A passphrase is the method that works from any device, so it is the sensible companion to a biometric key tied to one laptop.
The Save to Secret Manager box is unticked by default. Tick it only if you want a copy of the passphrase kept in your Secret Manager, encrypted on your device first. Otherwise the passphrase exists only where you put it.
Changing a passphrase
Click Update next to the BlockWill Secret. First BlockWill asks you to verify with an Account Passkey (or MFA) on a separate page. Then enter the current passphrase and click Verify & Continue, set the new passphrase, and click Update BlockWill Secret.
If your account has no Account Passkey or MFA yet, set one up first. Updating and removing keys both need it.
Naming keys
Name a key when you create it. "MacBook Touch ID" means something in a year; "Key 2" does not.
Naming only happens at creation. There is currently no way to rename a key afterwards, so it is worth a moment's thought.
Removing a key
Click Remove next to the key, type the key's name and click Continue. Then verify with your Account Passkey on the Confirm Vault Key Removal page. The app will not let you remove your last remaining key ("Cannot remove last remaining Vault key"): something has to open the vault.
Why more than one
Each key holds its own wrapped copy of the same underlying vault key. Losing one device costs you nothing as long as another method still exists. Losing every method means the contents cannot be recovered by anyone, including BlockWill. That is a design decision, not a limitation, and it is the reason the app keeps asking you to add a second key.
Register your second key while you still have the first. There is no recovery path once you are locked out.