User guide

Using BioVault

Store passwords and secure notes in your browser, and unlock them only with a fresh face scan in the Yanez YID app.

Version0.15

UpdatedNovember 3, 2026

AudienceVault owners

StatusAlpha

Warning: BioVault is in Alpha and hasn't had an independent security review. It may change, break, or lose data. Don't use it as the only place you keep a password or secret. If none of your approved YID phones still works, only your recovery kit and a new phone where you register YID can open your vault again.

1About BioVault

BioVault is a password manager that runs in your web browser. It opens only after you approve with a fresh face scan in YID, so someone who knows your phone or computer passcode can't open your locked vault.

The following three parts work together every time you use BioVault:

Your browser

Encrypts and decrypts your items. Holds a browser key that never leaves it.

BioVault server

Stores only encrypted data. Releases its part of the unlocking key after YID approves.

YID on your phone

Verifies your face and signs each approval. Stores nothing from your vault.

Neither your browser nor the server can open the vault alone.

With BioVault, you can do the following:

Store passwords, with a title, website, username, password, and notes.
Store secure notes, with a title and a plain-text note.
Search, reveal, copy, generate, edit, and delete items while the vault is unlocked.
Use your vault in more than one browser, on phones and computers.
Review security events, such as new browsers and failed unlock attempts.
Create a recovery kit that restores access if you lose every browser.

2Before you start

To use BioVault, you need the following:

The YID app on your phone, set up with face verification. Allow camera access when YID asks.
A current web browser on a phone or computer. Don't use a private or incognito window, because it deletes BioVault's browser key when you close it.
An internet connection every time you unlock.

Warning: Each browser holds one of the keys to your vault. If every enrolled browser loses its key and you have no recovery kit, nobody can open the vault—not you and not support.

Right after you create a vault, do the following:

Pair a second browser. For details, see Add another browser.
Create a recovery kit. For details, see Recovery kit.

3Create a vault

To create a vault, do the following:

Open BioVault and choose Create new empty vault.
Read Before you start. In Name for this browser, enter a name that you'll recognize later, such as Chrome on work laptop.
Select the checkbox to confirm that you understand you can lose access without another browser or a recovery kit.
Choose Continue with YID.
Approve the request in YID. On a phone, choose Open YID on this phone. On a computer, scan the QR code with your YID phone.
In YID, check that the request names BioVault, shows Create a new empty vault, and shows the same matching code as your browser. Then complete the face scan.

Your new vault opens right away, so you can add items without another face scan. It locks like any unlocked vault: when you choose Lock now, after two minutes without use, or ten minutes after you created it. BioVault also tells you whether the browser granted persistent storage, which makes the browser less likely to delete its key when disk space runs low.

Note: A new empty vault never restores, replaces, or deletes any other vault, even if you use the same YID identity.

4Unlock and use your vault

Unlock your vault

To unlock your vault, do the following:

Open BioVault. Under Vaults enrolled in this browser, choose your vault.
Choose Unlock with YID.
Approve in YID, either with Open YID on this phone or by scanning the QR code.
Check that YID shows BioVault, Unlock BioVault, and the same matching code. Then complete the face scan.

Each request expires after two minutes. If it expires, choose Unlock with YID again.

Warning: Only approve requests that you started. If YID shows a different action or a different matching code, cancel the request and don't approve it.

Work with items

The following table describes what you can do while the vault is unlocked:

Task	How
Add an item	Choose Add password or Add secure note, fill in the fields, and choose Save.
Find an item	Type in the search box. BioVault searches titles, websites, and usernames inside your browser.
View or edit an item	Select it in the list, change the fields, and choose Save.
Use a password	Choose Reveal to show it, Copy to copy it, or Generate to create a random 20-character password.
Delete an item	Open it, choose Delete, and confirm. Deleting is permanent.
Resolve an edit conflict	If BioVault says the item changed elsewhere, choose Reload to see the latest version, and then make your change again.

Note: BioVault can't clear your clipboard. After you paste a copied password, clear the clipboard yourself if other people use your device.

When the vault locks

BioVault locks automatically to protect your items. The following table lists when it locks:

Event	Result
You choose Lock now	The vault locks immediately.
You choose the BioVault logo to go back to the start page	The vault locks. BioVault asks first if you have an unsaved change.
You don't use the vault for two minutes	The vault locks. The top bar shows a countdown. Time spent in another tab or app counts, so switching away briefly keeps the vault unlocked.
Ten minutes pass after you unlock	The vault locks, even if you're still using it.
You lock the vault in another tab	The vault also locks in this tab.

If the vault locks while you're editing, BioVault discards the unsaved change and tells you. To keep a change, choose Save before you step away.

5Add another browser

Pairing a second browser is the simplest way to avoid losing access. If one browser loses its key, the other one still opens the vault and can pair a replacement.

To pair a browser, you need the new browser, a browser that already opens the vault, and your YID phone.

On the new browser

Open BioVault and choose Use an existing enrolled browser.
Enter a name for this browser and choose Get pairing code. The code expires after five minutes.

On the browser that already opens the vault

Open your vault. On the Browsers tab, go to Pair a new browser.
Enter the code from the new browser and choose Continue.
Check that the matching code is the same on both screens and in YID. Then approve in YID. This one approval also unlocks this browser and sends the vault key to the new browser.

The new browser finishes enrolling and starts locked. Unlock it once with YID to see your items. This second approval is deliberate: if you ever approve a pairing by mistake, that browser still can't read your items unless you also approve its unlock.

Note: Pairing needs one face scan on the browser that already opens the vault. Never share a pairing code with anyone.

6Manage your vault

When your vault is locked, the tabs under the unlock card let you manage it. The following table describes each tab:

Tab	What you can do
Security inbox	Review events such as a new browser, a revoked browser, changed YID keys, several failed unlock approvals, and recovery kit changes. To dismiss an event, unlock first.
Browsers	See every enrolled browser, revoke a browser, and pair a new one.
YID phone	See the phones whose YID approval the vault accepts, move to a new YID phone, and remove an old phone.
Recovery kit	See whether a kit exists, and create, replace, or delete it.
Delete vault	Remove the vault from this browser only, or delete it everywhere.

Revoke a browser

Revoke a browser that you no longer use, or one that you think someone else can access. To revoke it, go to the Browsers tab, choose Revoke next to the browser, and approve in YID.

The following rules apply:

You can't revoke the last working browser. A browser counts as working if it unlocked the vault in the last 24 hours.
A revoked browser can't unlock again. Anything it already showed stays exposed, so change those passwords.

Move to a new YID phone

Do this while your old phone still works. If you lose your only phone, you'll need your recovery kit to add a new one. See Recovery kit. To move your vault to a new phone, do the following:

On the YID phone tab, choose Move to a new YID phone.
Scan the request with your new phone. This step only finds the new phone and grants no access.
When BioVault shows Found your new phone, choose Continue.
Scan the same request with your old phone and with your new phone.
Unlock the vault with the new phone to test it.
After the test works, remove the old phone on the YID phone tab.

Each entry on the YID phone tab is the set of keys added in one step, which is normally one phone. If you added a phone's keys in more than one step, that phone is listed more than once. Remove each of its entries to remove the phone.

The new phone must use the same YID identity as the old one. A different YID identity can't be added.

Delete the vault

Go to the Delete vault tab, choose one of the options below, type DELETE, and choose Delete.

Remove from this browser only: this browser forgets the vault and its keys. Nothing changes on the server, and your other browsers and recovery kit keep working. No YID approval is needed. If this is your only browser and you have no recovery kit, nobody can open the vault afterwards.
Delete everywhere: approve in YID. BioVault deletes every item and the recovery kit from the server and signs out every paired browser. A recovery kit can't bring the vault back. When you next open the vault on another paired browser, it tells you which browser deleted the vault and when, and removes its copy. You can't undo it.

Ask Yanez to delete a vault

Deleting a vault in BioVault needs approval from your YID phone. If no approved YID phone works, you can ask Yanez to delete the vault instead. You need your recovery kit file. To ask Yanez, do the following:

In a browser, open BioVault and choose Recover with a recovery kit.
Choose Ask Yanez to delete the vault instead.
Select your kit file and choose Show deletion proof. If this browser still has the vault, the page shows the vault name. Check that it's the vault you want to delete.
Copy the proof and email it to biovault@yanez.ai. Don't send the kit file itself.

The proof shows that you hold the kit, but it can't open your vault. After Yanez checks the proof, the following happens:

Yanez emails a notice to the email address on file for the vault. The notice names the vault and the date of the deletion.
Yanez waits 7 days. To stop the deletion in that time, reply to the notice, or unlock the vault with a working YID phone.
After the 7 days, Yanez deletes the vault and its items. When you next open the vault on a paired browser, it tells you that Yanez deleted the vault. You can't undo it.

Without a recovery kit, Yanez can't know that the request comes from you, so Yanez doesn't delete the vault. It stays on the server, encrypted, and nobody can open it. If the vault has no email address on file, Yanez can't send the notice, so Yanez doesn't delete the vault either.

7Where your data is stored

Your items are stored on the BioVault server, but only in encrypted form. The keys that open them are split between your browser, the server, and, if you create one, your recovery kit file.

The following table lists every place BioVault keeps data:

Location	What's stored	How it's protected
Your browser's site storage	One record per vault: account and vault IDs, the browser name, the browser key, and a browser sign-in key.	Both keys are non-extractable. BioVault's code can use them, but can't read or export them. They're saved in the browser profile's files, not in hardware.
Browser memory, while unlocked	Decrypted items and the keys needed to read them.	Held only in memory. Cleared when the vault locks.
BioVault server	Encrypted items, encrypted key envelopes, encrypted server keys, the recovery envelope, account and browser records, and security events.	Items and keys are encrypted. Server keys are also encrypted under a server master key.
Your recovery kit file	A random recovery secret and IDs that locate your vault.	Wherever you save it. The secret is never sent to the server.
YID app on your phone	Your biometric signing keys.	Kept on your phone by YID. Contains nothing from your vault.

BioVault doesn't keep vault data in browser caches, cookies, or local storage, and the server tells browsers not to cache its responses.

What the server can and can't see

The server can see

How many items you have, their sizes, and when they change.
Your browser names and when each one unlocks.
Your YID identifier and approved YID public keys.
Request times and network addresses.

The server can't see

Any item content, including titles, websites, and usernames.
Your passwords and notes.
The vault key or your browser key.
The recovery secret in your kit file.

What deletes a browser's key

Each browser keeps its key in its site storage for BioVault. The following actions delete that key:

Clearing browsing data with Cookies and other site data selected. Many browsers select this by default.
Deleting site data for BioVault in browser settings or developer tools.
A setting that deletes site data when you close the browser.
Closing a private or incognito window.
Deleting the browser profile, or the browser deleting site data when disk space is low.

Clearing only cached images and files, clearing history, or restarting keeps the key. If a browser loses its key, your encrypted items stay safe on the server, but that browser can't open the vault until you pair it again or recover.

8How your data is encrypted

BioVault encrypts every item in your browser before it's uploaded. The key that decrypts your items is locked inside two layers, and each layer needs a different key.

Item encryption

Your browser encrypts each item with a random vault key, using AES-256-GCM. Every field is encrypted, including the title. Each save uses a fresh random value and is bound to its vault, item, and version. If someone moves or swaps items on the server, decryption fails and BioVault shows the item as damaged instead of displaying it. The server could still send back an older saved copy of an item, and BioVault would show that older copy, because nothing outside the server records which copy is the newest.

Two locks on the vault key

The vault key is never stored unencrypted. The following diagram shows how it's protected:

Everyday unlock

Browser keyOnly in this browser

Server keyReleased after YID approval

Vault keyDecrypts your items

Recovery

Recovery secretOnly in your kit file

Server recovery keyReleased after YID approval

Vault keySame key, separate copy

Each enrolled browser has its own browser key and server key. The recovery kit has its own pair.

This design means that no single party holds everything needed to decrypt your vault:

The server holds the server key but never your browser key or recovery secret.
Your browser holds its browser key but gets the server key only after a fresh YID approval.
Your kit file holds the recovery secret, but the server recovery key is released only after a fresh YID approval.

What happens when you unlock

The following steps happen each time you unlock:

RequestYour browser signs in with its own key and asks for approval. Signing in alone grants no access.

ApproveYID checks your face and signs the exact request, which names the vault, browser, and session.

VerifyThe server checks the signature against the YID keys approved for your vault.

DecryptThe server sends the server key, encrypted for this tab only. Your browser opens both layers and decrypts items locally.

When the vault locks, your browser clears the vault key, the server key, and decrypted items from memory, and the server ends the unlock session.

Who can open your vault

Someone who has	Can open the vault?	Why
Your phone or computer and its passcode	No	Unlocking still needs your face approval in YID.
A copy of the server database	No	It doesn't contain any browser key or recovery secret.
Only your recovery kit file	No	The server recovery key also needs approval from your YID phone.
An enrolled browser and your YID phone	Yes	This is the everyday unlock.
Your recovery kit file and your YID phone	Yes	This is recovery.

Technical summary

The following table lists the algorithms BioVault uses:

Purpose	Algorithm
Item encryption and key layers	AES-256-GCM
Delivering keys to a tab	ECDH P-256, HKDF-SHA-256, and AES-256-GCM
Browser and tab signatures	ECDSA P-256
Deriving recovery keys from the kit secret	HKDF-SHA-256
YID approvals	BLS signatures on BLS12-381
BioVault requests to YID	Ed25519 signatures

9Recovery kit

A recovery kit is a file you download. Together with your YID phone, it restores access to your vault if you lose every enrolled browser. If you lose your YID phone too, the kit works with a new phone where you register YID.

Each vault has at most one kit. Creating a new kit replaces the old one.

Create a recovery kit

Create a kit while an enrolled browser still works. To create one, do the following:

Open your vault. In the Recovery kit section, choose Create recovery kit. It's below your items when the vault is unlocked, and on the Recovery kit tab when it's locked.
Approve the request in YID. That one approval is enough: BioVault prepares the kit and opens Save your recovery kit.
Choose Download recovery kit and save the file somewhere outside this browser.
Under Confirm the saved file, select the file you saved and choose Confirm. Confirm within ten minutes.

The kit becomes active only after you confirm. Until then, any previous kit keeps working.

Keep the kit safe

BioVault keeps no copy of the kit, and the server never learns the secret in it. Store the kit where you can reach it without your browser, and where other people can't. The following places work well:

A separate password manager.
An encrypted USB drive that you keep in a safe place.

Warning: The kit file alone can't open your vault. Recovery also needs your face scan in YID, on your phone or on a new phone where you register YID. Anyone who has your kit and passes the YID face check as you can recover the vault. Someone who has your kit can start a recovery and try to trick you into approving it, so approve a RECOVER vault request only if you started it yourself, in your own browser. Use the kit only on the BioVault site. Never upload it anywhere else or send it to anyone, even someone who says they're BioVault support.

Recover your vault

If you still have a browser that opens this vault, pair the new browser instead. See Add another browser. Pairing keeps your other browsers and your recovery kit working. Recovery revokes every other browser and uses up the kit. The Recover a vault screen also has a Pair this browser instead button.

To recover your vault, do the following:

In a browser, open BioVault and choose Recover with a recovery kit.
Select your kit file, enter a name for this browser, and choose Continue.
Check that YID shows RECOVER vault and the same matching code. Then approve with your YID phone. If you lost it, install YID on a new phone, register with your face, and approve with the new phone.
BioVault enrolls the browser and unlocks the vault. The same approval also makes a new recovery kit, so no second face scan is needed.
On Save your new recovery kit, choose Download recovery kit, save the file somewhere outside this browser, then select it under Confirm the saved file and choose Confirm. Confirm within ten minutes of starting the recovery.

After you recover

Recovery treats every other browser as possibly lost or stolen. When recovery finishes, the following happens:

Every other browser for this vault is revoked.
The kit you used is deleted and stops working.
A Vault recovered event appears in the security inbox.
If you approved with a new phone, BioVault adds it to your vault. The lost phone stays on the YID phone tab until you choose Remove next to it. If your vault has an email address, BioVault also emails you about the recovery.

The new kit works only after you confirm the saved file. If you choose Later instead, the new kit is discarded, and you can make one from the Recovery kit section, which needs another approval in YID. Until the vault has a kit, the vault page shows a warning.

Next, pair a second browser.

Replace or delete a kit

In the Recovery kit section, below your items when the vault is unlocked or on the Recovery kit tab when it's locked, choose Replace recovery kit or Delete recovery kit, and approve in YID. After you replace or delete a kit, the old file no longer works. Revoking browsers or changing YID keys doesn't affect the kit.

10When recovery can restore access

A recovery kit replaces lost browsers. With a new phone where you register YID, it also replaces a lost YID phone. Without a kit, a lost phone can't be replaced.

The following table shows what you can do in common situations:

Situation	Access restored?	What to do
You lost one browser, and another enrolled browser still works.	Yes	No kit needed. Pair a replacement from the working browser, and then revoke the old one.
You lost every enrolled browser, and you have your kit and your YID phone.	Yes	Recover with your kit.
You're replacing your phone, and the old phone still works.	Yes	No kit needed. On the YID phone tab, choose Move to a new YID phone.
You revoked browsers or changed YID keys after creating a kit.	Yes	The kit keeps working. No action needed.
You lost your kit file, but you can still open the vault.	Not needed	Create a new kit. It replaces the lost one.
Someone else might have your kit file.	Not needed	Replace or delete the kit right away. The old file then stops working.
You lost every enrolled browser and have no kit.	No	The vault can't be opened, even with a working YID phone. You can create a new empty vault.
You lost, erased, or reinstalled your YID phone, no other approved phone works, and you have your kit.	Yes	Install YID on a new phone and register with your face. Then recover with your kit and approve with the new phone. The recovery adds the new phone to your vault.
You lost, erased, or reinstalled your YID phone, no other approved phone works, and you have no kit.	No	The vault can't be opened, even with a working browser. A reinstalled YID app has new keys that your vault doesn't trust.
You deleted the vault.	No	Deletion removes items and the kit permanently.

Note: Your phone passcode, email, a new YID registration without a kit, and BioVault support can't restore access in any of these situations. A phone you removed from your vault can't come back through a recovery.

11Troubleshooting

The following table explains messages you might see and what to do:

Message or problem	What it means and what to do
No vault is enrolled in this browser.	This is a new browser, or its site data was cleared. Pair it from another enrolled browser, or recover with your kit.
This browser can't open that vault.	The browser was revoked, the vault was deleted, or the browser key is missing. Pair the browser again or recover with your kit.
Only this browser can open this vault, and there's no recovery kit.	You have one enrolled browser and no kit. Pair a second browser or create a recovery kit soon.
This request expired.	You didn't approve within two minutes. Start the action again.
Too many attempts.	Wait a moment and try again.
This recovery kit isn't valid.	The file is wrong, or the kit was replaced, deleted, or already used. Use your latest kit.
This item changed or was deleted elsewhere.	Another browser changed the item. Choose Reload, and then make your change again.
The Open YID on this phone button doesn't open YID.	Open YID and scan the QR code instead.
BioVault is unreachable.	Your vault stays locked. Check your internet connection and try again.

12Good practices and limits

Good practices

Pair at least two browsers, such as your phone and your computer.
Create a recovery kit and store it outside your browser.
Move to a new YID phone before you reset, trade in, or give away your old phone.
Only approve YID requests that you started, and always check the matching code.
Review the security inbox, and revoke browsers you don't recognize.
Before you revoke a browser, unlock another browser so that at least one browser counts as working.

Limits

BioVault protects a locked vault. It can't protect against everything. Keep the following limits in mind:

Unlocked vaults are readable. Malware, a malicious browser extension, or a compromised operating system can read items while the vault is unlocked.
The server sends the app code. BioVault runs as a website, so your browser runs the code that the server sends. Someone who controls the server, such as an attacker or a Yanez operator, could change that code to read your items the next time you unlock.
The server can change the lists of browsers and phones. In the app, adding or removing a browser or a YID phone needs your face approval. Someone with direct access to the server database could still change these lists. Yanez operators don't do this. A change to a list alone doesn't let anyone read your items.
Revealed secrets stay revealed. Locking or revoking can't take back a password that was shown, copied, or captured in a screenshot.
Browser keys live in profile files. Someone who can copy your browser profile files might copy the browser key. They would still need your YID approval to unlock.
Deleted items can linger. A deleted item is removed from the vault immediately, but its encrypted bytes can remain in server database files and backups for a time.
Alpha limits. The design hasn't had an independent security review. The server master key is kept in a configuration file on the server.

13Glossary

Approved YID key: A YID public key that your vault accepts approvals from. Keys from a new phone aren't approved until you add them, or until a recovery with your kit adds them.
Browser key: A key that each enrolled browser creates and keeps in its site storage. It never leaves the browser.
Enrolled browser: A browser that holds a browser key for your vault and can unlock it with YID.
Matching code: A short code that BioVault and YID both show, so you can confirm that you're approving your own request.
Pairing code: A one-time code, valid for five minutes, that connects a new browser to an enrolled browser.
Recovery kit: A file that holds a recovery secret. With your YID phone, or a new phone where you register YID, it restores access after you lose every browser.
Server key: A key the server keeps for each browser and releases only after a fresh YID approval.
Vault key: The random key that encrypts your items. It's stored only inside encrypted layers.

BioVault user guide, version 0.15, updated November 3, 2026. This guide describes BioVault Alpha. For technical details, see docs/DATA-AND-ENCRYPTION.md and docs/RECOVERY-KIT.md.