Password Vault Overview
The 4-digit PIN of Password Vault opens your vault: without it, the web part shows no entries, and the key that decrypts them is derived from it. You set it when you first open the web part (see KB10442. How to Set Up Your PIN in Password Vault), and you can change it at any time - for example, if someone may have seen you type it. The vault must be unlocked. The current PIN is needed only to unlock it; an already unlocked session does not ask for it again.
Before you start
- The vault must be unlocked. The current PIN is needed only to unlock it; an already unlocked session does not ask for it again.
- Other open copies of the vault do not need to be closed. If Password Vault is open in another browser tab, on another device or in Microsoft Teams, that page detects the change the next time it reads or writes the vault file, then locks itself and asks for the new PIN (see Other open pages).
- Choose a new PIN you will remember. A new PIN is typed only once; there is no confirmation field.
Changing the PIN
- Open any page or Teams tab with the Password Vault web part and unlock the vault: type your current PIN in the Enter PIN prompt that is shown instead of the list (Enter your PIN to proceed). It is checked automatically after the fourth digit. If the vault is already unlocked, skip this step.
- Click the gear icon button Configure at the top right of the web part and select Change PIN. The gear is shown only while the vault is unlocked.
- The Change PIN screen replaces the list. Type the new 4-digit PIN in the four boxes. The digits are visible as you type - check them before you continue, and make sure nobody is watching your screen.
- Click Change PIN. The button becomes available once all four digits are entered. To keep the current PIN, click Cancel instead.
- The list of entries returns with the message The PIN has been changed. From now on, use the new PIN on every page, device and Teams tab.
The vault stays unlocked after the change, so you can continue working without entering the new PIN right away. The next time the vault locks, it asks for the new PIN.
❗ Important
Clicks and key presses on the Change PIN screen count as activity, so the vault does not lock while you type the new PIN. Only if the screen is left untouched for five minutes does the automatic lock close it: the PIN prompt is shown instead of the list and the PIN stays unchanged. Simply unlock the vault and start again from the Configure menu. The automatic lock is described in KB10451. Automatic Lock: When Password Vault Asks for the PIN Again.
What happens to your entries
The encryption key of your entries is derived from your PIN with PBKDF2-SHA256 (a random salt, 600,000 iterations) in your browser and is kept only in memory during the unlocked session. When you click Change PIN, the web part therefore derives a new key from the new PIN with a new random salt, decrypts every entry with the old key and encrypts it again with the new one, in your browser, and saves the vault file to your OneDrive in one operation. Name, user name, password, URL, notes, folder and tags of all entries are re-encrypted; favorites are kept.
- Your entries do not change: nothing is added, removed or altered.
- The modification dates stored with the entries are kept, so a PIN change does not make all entries look recently edited.
- The failed-attempt counter is reset to zero.
If the save fails, the error bar Sorry, something went wrong. Please refresh the page and try again. appears on the Change PIN screen and the old PIN remains valid. Refresh the page and repeat the steps. This assumes the PIN has not been changed on another page in the meantime.
📝 Note
The PIN controls access inside the web part and is used to derive the encryption key, but it is not the only protection of your data: the vault file lives in your own OneDrive and is protected by Microsoft 365 access control. Details are in KB10452. How Password Vault Protects Your Data: Encryption, PIN and Storage.
Other open pages
A page that was already open before the change notices the new PIN the next time it reads or writes the vault file - when you click Refresh, save a change or unlock the vault there. It then locks itself and asks for the new PIN; the old PIN no longer works on it. A change made on such a page is not saved, so an outdated page can no longer undo the PIN change. To bring the other pages up to date at once:
- click Refresh (the icon button at the top right of the web part) or reload every other page, tab or Teams app where your vault is open; or
- close those pages and open them again.
After that, they ask for the new PIN.
If you have forgotten your PIN
If the vault is still unlocked, you can change the PIN without entering the old one. Complete and save the change before the vault locks; the entries are preserved when the save succeeds. If all sessions are locked and you have forgotten the PIN, Password Vault provides no recovery function for you, your administrator or Vitextra. Resetting a blocked vault deletes all entries. Keep important credentials in another location approved by your organization as well. KB10460. I Forgot My PIN in Password Vault: What Are My Options? · KB10461. Why Password Vault Is Blocked: "You've Entered an Incorrect PIN Too Many Times"
💡 Tip
Choose a PIN that is not your phone unlock code, your bank card PIN or an obvious sequence such as 1234 or 0000, and keep a note of it in a safe place in line with your organisation's policy. Keep the most important credentials also in another approved place, so that a forgotten PIN does not mean losing access to them.
