Docs / Items and Credentials

Store more than passwords.

Use purpose-built item types, extend Logins with passkeys and Authenticator, and run saved SSH commands on desktop.

Understand items and fields

Each vault contains a flat list of items. An item type supplies its default fields, while custom fields let you extend an item without creating a new type. Concealed fields are kept outside the searchable index and decrypted only when requested.

Login extensions are different from item types. Authenticator and passkeys belong to a Login and synchronize with it. They do not appear as separate vault items.

Choose an item type

9Secure includes Login, Payment Card, Bank Account, Address, Identity / Passport, Software License, WiFi Network, Crypto Wallet, API Credential, SSH Key, Secure Note, File, and Custom.

  • Choose Login for usernames, passwords, websites, passkeys, and Authenticator setup.
  • Choose SSH Key for a public key, concealed private key, concealed passphrase, notes, and reusable commands.
  • Choose Custom when no built-in schema fits.

Add Authenticator to a Login

  1. Create or edit a Login.
  2. Select Add Authenticator.
  3. Paste a Base32 secret or otpauth://totp URI, then save.
  4. Open the Login to copy the rotating code. Windows and macOS can also deliver it through Vaultlight.

Manual Base32 secrets use SHA-1, six digits, and a 30-second period. TOTP URIs can specify SHA-1, SHA-256, or SHA-512, six or eight digits, and a period from 1 through 300 seconds. HOTP is not supported.

Authenticator is supported in the Windows, macOS, iOS, and Android apps. The setup value is one concealed TOTP field on the Login. Codes are generated locally on demand and require an accurate device clock.

Enable and use passkeys

Passkeys are supported in the Windows, macOS, iOS, and Android apps where the operating system exposes a compatible credential-provider API. A passkey is an independently protected concealed credential attached to a Login, not a new item type or a normal custom field.

  • Windows: use the passkey onboarding screen or Settings to register 9Secure, then enable it under Settings > Accounts > Passkeys > Advanced options. System integration requires Windows 11 24H2 build 26100.6725, Windows 11 25H2 build 26200.6725, or later. Windows 10 does not provide the required provider API.
  • macOS and iOS: enable 9Secure under Password AutoFill. Passkey AutoFill requires macOS 14 or iOS 17 or later.
  • Android: open Android's passwords and passkeys settings and enable 9Secure. Passkey provider support requires Android 14 or later and a device that exposes the credential-provider settings.
  1. Start passkey creation from a supported website or app.
  2. Choose 9Secure as the passkey provider.
  3. Unlock the keyring if requested.
  4. Choose an existing Login without a passkey. Create the Login in 9Secure first if no suitable Login exists.
  5. Use the same provider flow when the website or app later asks you to sign in with the passkey.

Open the Login in 9Secure to review or remove its passkey. Passkeys synchronize as concealed Login data. A successfully received passkey is marked backed up only after authenticated Sync commits it durably.

Know the passkey boundaries

9Secure stores ES256 passkey key material and account metadata inside a versioned concealed credential. The private key is never exposed through ordinary fields or generic plaintext vault export. Passkey imports from browser or password-manager exports are not supported.

The operating system and native credential-provider extension own browser or app integration, request transport, user verification, and interface. 9Core validates the WebAuthn ceremony data and performs credential operations. A compromised unlocked device or malicious provider path can still misuse credentials that the user authorizes.

Create an SSH Key item

  1. Select New Item, then choose SSH Key.
  2. Enter the public key, private key, passphrase, and notes you need.
  3. Select Add Command for each reusable command, then give it a short title and the complete command text.
  4. Save the item.

The private key and passphrase are concealed. Command titles and command text are ordinary text fields, so they are part of the decrypted searchable index while the vault is unlocked. Commands and key fields synchronize with the SSH Key item.

Run SSH commands on desktop

Windows and macOS can run a saved command from the SSH Key item or from its Vaultlight action. Select the play action beside the command. Mobile apps can store, view, edit, and synchronize SSH Key commands but do not execute them.

On macOS, 9Secure runs the complete text through zsh. On Windows, it runs through cmd.exe. The process starts in your home folder, and the saved passphrase is supplied through a temporary SSH askpass helper when an SSH client requests it. The stored private-key field is not installed, written to ~/.ssh, or added to an SSH agent automatically.

A saved command is executable shell input. Review it before running. Shell operators, scripts, and non-SSH programs are not blocked. Never run a command received from an untrusted vault or device. 9Secure captures limited output for status reporting, but successful execution does not prove that the intended remote action completed.