Password generator, password vault and secure share

Three tools under Tools. All three do their cryptography in your browser; DVSentry stores only ciphertext and cannot read your passwords or shared secrets.

#Password generator

Tools → Password generator (also public at /password-generator, no account needed).

• Random passwords (length and character sets) or passphrases from the BIP-39 English word list.
• Uses crypto.getRandomValues with rejection sampling (no modulo bias). The entropy shown is counted exactly over the sets actually used.
• Nothing is sent, stored or logged. Copy clears the clipboard after 30 seconds while the page is open; DVSentry cannot reach your clipboard history or sync.

#Password vault

Tools → Password vault: an end-to-end encrypted vault for your own logins.

#Set up (once)

1. You need MFA on your account. Set up asks for a fresh MFA code.
2. Choose a vault passphrase. It never leaves your browser; your browser derives a key from it.
3. Write down the 12 recovery words shown once. They are the only way back if you forget the passphrase. DVSentry has no recovery, escrow or admin read path.

#Use it

• Entries hold site, username, password, nickname, notes and an optional TOTP seed. Paste an otpauth:// link or a base32 key, or decode a QR image (decoded locally in a worker); the vault then shows the current 6-digit code. DVSentry refuses to store its own MFA factor in the vault.
• Import a CSV from another password manager (batches of 100) and export a CSV (TOTP seeds only after a second confirmation).
• Breach check: the browser sends the first 5 hex characters of the password's SHA-1 to Have I Been Pwned's range API from a dedicated worker, with padding. Never the password, the full hash or a username.
• Delete asks in the row and offers Undo for 15 seconds.
• The vault locks after 15 minutes idle, when you leave the page, or when another tab locks it.
• "Vault state N · 8 words" is a fingerprint you can compare between devices, and "since you last opened" shows what changed. Admins see vault names and counts only. You get an alert when an item changes or a new browser opens the vault.

Limits: Free and trial 1 vault × 50 entries; paid plans 10 vaults × 1,000 entries. Removing a member deletes their personal vaults. The page shows "N of M used".

The browser files that handle keys are published with their SHA-256 at /.well-known/dvsentry-client-hashes.json, and a signed manifest at /.well-known/dvsentry-vault-manifest.json, so anyone can check what code the vault page runs.

#Secure share

Tools → Secure share sends a secret or a file through a link that opens a limited number of times. Not yet available to every organization during the beta; the page says so when it is not.

1. Type the secret (up to 5 KB) or pick a file, choose how long the link lives (5 minutes to 72 hours) and how many views (1-10), or pick up to 10 members who may each open it once. Optionally add a passphrase. Generate one fills in a 6-word passphrase.
2. Your browser encrypts it with AES-256-GCM. The key is in the link's #fragment, which browsers never send to a server; DVSentry stores ciphertext only.
3. Send the link (and the passphrase through another channel). The recipient opens /s/<id>; the last view, revoke or expiry clears the ciphertext.

File limits: Free/trial 5 MB per file and 25 MB live; paid 25 MB and 100 MB. Files are never scanned; the recipient's browser checks the decrypted file's type. There is no "recover a share" path.

Something missing or unclear? Tell us with Feedback in the app.