Creating Safes
Overview
A Safe is a personal encrypted vault. On your node, Safes are created with Safe registration codes that you issue from the admin app. You can create Safes for yourself and invite others to create their own.
Your administrator account manages the server. It is separate from the Safe you use to store your own data. You can be both the administrator and a Safe user, but those are separate logins with separate PINs and recovery material.
Safe registration codes vs admin setup codes
| Code | What it does | Who gets it |
|---|---|---|
| Admin setup code | Registers the administrator once. It is printed by the launcher and expires after 30 minutes. | Only you, the operator. Never give it to a Safe user. |
| Safe registration code | Allows a new Safe to be created. You create it in Safes. It is time- and use-limited. | You, for your own Safe, or a person you invite. |
Create your first Safe
- Complete First setup, including Unlock Node and the Setup checks.
- Open Safes and create a Safe registration code. For your own first Safe, use a short-lived code that permits one use. Copy it while it is displayed.
- From Home, choose Open UnoLock, or open
https://node.example.com/. - Confirm the hostname and HTTPS certificate.
- Choose Create Vault, the browser app's current label for creating a Safe, and enter the Safe registration code.
- Follow the prompts to register your Safe credential, choose its PIN, and save the recovery material it gives you.
- Sign out and open the Safe again.
- Save a test note, upload a small test file, and download it to check that the contents match.
Invite others
To let someone else create a Safe on your node:
- In Safes, create a Safe registration code for them.
- Give them the node's HTTPS URL, such as
https://node.example.com, and the Safe registration code. - Point them to the Safe user guide.
- Keep your admin credentials private.
The person then opens the node URL, confirms the hostname and HTTPS certificate, chooses Create Vault, enters the code, registers their device, chooses their Safe PIN and saves every recovery item it presents.
If a registration code is expired or already used, they need a new code from you.
People with Safes on your node come to you with access and operational questions. See Operator responsibilities.
Open an existing Safe
- Return to the same permanent node URL.
- Choose the existing-Safe/open action shown by the browser app.
- Use the passkey or device credential and Safe PIN registered for that Safe.
- If the browser reports that a client update is ready, review and accept it. The browser then activates the downloaded version and reloads.
Passkeys are scoped to the node's permanent WebAuthn domain. A different hostname, an HTTP URL, or a copied browser bundle at another origin is not an equivalent login location.
Recovery material
Each Safe creates its own recovery material when it is registered. Save every recovery item it presents.
The administrator cannot recover a Safe
The node administrator cannot see the Safe PIN, plaintext, or private content keys, and cannot reconstruct missing user recovery material. Keep Safe recovery material separate from the device normally used to open the Safe.
To recover a Safe, use the recovery action shown by the browser app and the recovery material created for that Safe. Test the recovery path before relying on it.
Safe recovery material is separate from the node's own backups and administrator recovery key. See Backup and recovery.
FAQs
Can I use the admin setup code to create a Safe?
No. The admin setup code registers the administrator once. Creating a Safe needs a Safe registration code, which you create in Safes.
Why is the button called Create Vault?
Create Vault is the browser app's current label for creating a Safe.
Someone's registration code no longer works. What do they do?
A registration code is time- and use-limited. If it is expired or already used, create a new Safe registration code in Safes and give it to them.
Can I be the administrator and a Safe user on the same node?
Yes. They are separate logins with separate PINs and recovery material. Your administrator account manages the server; your Safe stores your own data.
Can the administrator restore a user's lost recovery material?
No. The administrator cannot reconstruct missing user recovery material. Each Safe user must save and protect their own.