Vaultwarden (Password Manager) — User Guide

Electric Monk provides Vaultwarden — a self-hosted, Bitwarden-compatible password manager at vault.electricmonk.io.

Features

• Password vault — securely store passwords, notes, credit cards, and identities
• End-to-end encrypted — your vault is encrypted with your master password before leaving your device
• Browser extensions — autofill passwords in Chrome, Firefox, Safari, Edge, and Brave
• Mobile apps — iOS and Android apps with biometric unlock
• Desktop apps — Windows, macOS, and Linux
• TOTP generator — built-in authenticator for two-factor codes
• Password generator — generate strong, random passwords
• Secure sharing — share credentials via Organizations
• SSO login — authenticate through Authentik (no separate registration needed)
• Password health reports — identify weak, reused, or breached passwords

Getting Started

Web Vault

1. Go to vault.electricmonk.io
2. Click Enterprise Single Sign-On
3. Enter your Authentik email address
4. Authenticate with Authentik
5. On first login, you'll be prompted to create a master password

Browser Extension

1. Install the Bitwarden extension from your browser's extension store
2. Click the extension icon → Settings (gear icon)
3. Under Self-hosted Environment, set:
   • Server URL: https://vault.electricmonk.io
4. Save and go back to the login screen
5. Click Enterprise Single Sign-On
6. Enter your email and authenticate with Authentik

Mobile App (iOS / Android)

1. Install Bitwarden from the App Store or Google Play
2. On the login screen, tap Self-hosted (or the region selector)
3. Set Server URL to https://vault.electricmonk.io
4. Save → tap Enterprise Single Sign-On
5. Enter your email and authenticate with Authentik
6. Enable biometric unlock (Face ID / fingerprint) in settings for convenience

Desktop App

1. Download Bitwarden Desktop from bitwarden.com/download
2. Go to Settings → set server URL to https://vault.electricmonk.io
3. Log in via Enterprise Single Sign-On

Master Password — How It Works

Your master password is the single most important credential you have. Here's how Vaultwarden uses it:

Encryption Model

Master Password → PBKDF2 (600,000 iterations) → Master Key → Encrypts your vault

1. Your master password is never sent to the server in plain text
2. It is stretched using PBKDF2-SHA256 with 600,000 iterations
3. The derived key encrypts/decrypts your entire vault locally on your device
4. The server only stores your encrypted vault — it cannot read your passwords
5. Even an administrator with full database access cannot decrypt your vault

Choosing a Strong Master Password

• Use at least 12 characters (16+ recommended)
• Include a mix of uppercase, lowercase, numbers, and symbols
• Consider a passphrase: 4–6 random words (e.g., "correct horse battery staple")
• Do not reuse a password from any other service
• Do not store your master password in the vault itself

Master Password Recovery

There is no "forgot password" recovery. If you forget your master password and have no other recovery method, your vault data is permanently lost.

This is by design — it's what makes the encryption trustworthy. The server never has access to your master password or decryption keys.

Recovery Options

Set these up before you need them:

1. Emergency Access (Recommended)

Designate a trusted person who can request access to your vault after a configurable waiting period:

1. Web vault → Settings → Emergency Access
2. Invite a trusted contact (they need a Vaultwarden account)
3. Set the wait time (e.g., 7 days) — this is the delay before they can access your vault
4. The trusted person can request access; you get notified and can reject it
5. If you don't respond within the wait period, they gain read-only (or takeover) access

2. Recovery Key / Backup

• Export your vault periodically: Tools → Export Vault
• Choose encrypted JSON format (protected by your master password)
• Store the export in a physically secure location (USB drive in a safe, etc.)
• Never store an unencrypted export digitally

3. Write It Down

• Write your master password on paper
• Store it in a physical safe, safety deposit box, or sealed envelope with a trusted person
• This is explicitly recommended by Bitwarden/Vaultwarden for critical accounts

What Happens If You Lose Your Master Password

Security Best Practices

Two-Factor Authentication (2FA)

Protect your vault with a second factor beyond your master password:

1. Web vault → Settings → Two-step Login
2. Recommended methods:
   • Authenticator app (TOTP) — use Bitwarden's built-in TOTP or a separate app
   • Security key (FIDO2/WebAuthn) — YubiKey, etc.
3. Save your 2FA recovery code somewhere outside the vault (paper, etc.)

Session Management

• Review active sessions: Settings → Sessions
• Deauthorize Sessions to log out all devices if a device is lost/stolen
• Set vault timeout: lock the vault after a period of inactivity
• Recommended: Lock (requires master password) rather than Log out (requires re-auth with SSO)

Browser Extension Security

• Set the extension to lock on browser restart
• Enable PIN or biometric unlock for convenience without reducing security
• Never save your master password in your browser's built-in password manager

Organizations (Shared Vaults)

Organizations let you share credentials securely with other users:

1. Web vault → New Organization
2. Invite members by email (they must have Vaultwarden accounts)
3. Create Collections to organize shared items
4. Assign collection access per-member

Shared items are encrypted — each member's copy is encrypted with their own keys.

Troubleshooting

"Invalid master password"

• Master passwords are case-sensitive — check caps lock
• Try typing it in a text editor first to verify
• If you've changed your Authentik password, your master password is unchanged (they are separate — Authentik is for SSO login, master password is for vault encryption)

Can't log in with SSO

• Ensure server URL is set to https://vault.electricmonk.io
• Try the web vault directly at vault.electricmonk.io
• Verify your Authentik account at auth.electricmonk.io

Vault not syncing

• Check your internet connection
• Pull down to refresh (mobile) or click the sync icon (extension/desktop)
• Verify the server URL is correct in your app settings