Password Vault Overview
Password Vault asks for a 4-digit PIN to open the vault; until then, it shows no entries. To make guessing the PIN harder, the number of incorrect attempts is limited: after five wrong PINs in a row the vault is blocked and can only be reset, which erases all entries. This article describes how the attempts are counted and what the reset does.
Summary
| Question | Answer |
|---|---|
| How many wrong PINs are allowed? | 4; the 5th wrong PIN in a row blocks the vault |
| Where is the counter kept? | In the vault file in the user's OneDrive |
| Does it count across devices, pages and Teams? | Yes, when the latest vault file can be read and the updated counter saved; see the limitations below |
| Does it reset with time? | No |
| What resets it? | A correct PIN (and a PIN change) |
| What happens after 5 wrong PINs? | Only the Reset screen is shown; Reset, after a confirmation, erases all entries and the PIN |
| Can an administrator or Vitextra unlock the vault? | No |
When a PIN is wrong
While the vault is locked, the web part shows the Enter PIN prompt instead of the entries. It checks the PIN as soon as the fourth digit is typed; the digits are masked while you type them. If the PIN is wrong, the boxes are cleared and the prompt shows:
- "The PIN is incorrect"
- Attempts left: the number of tries that remain before the vault is blocked.
The Attempts left line is shown on the prompt from the start whenever earlier wrong attempts exist - also after the page is reloaded or on another device - and not only after a failure on the current page. You can try again at once or leave the page and come back later. Leaving or reloading the page does not reset the counter.
How the attempts are counted
The web part shows The PIN is incorrect and the number of attempts left. When the save succeeds, the counter is stored in the vault file, so attempts count across devices and sessions. A correct PIN or a PIN change resets the counter; saving that reset to the file also requires a successful write. If the file cannot be read or the counter cannot be saved, the page may use cached data and a failed attempt may be counted only locally; restore the connection and refresh before continuing. After 5 incorrect PINs in a row, the vault is blocked with the message You've entered an incorrect PIN too many times. and only Reset is available.
After five failed tries: the Reset screen
The fifth wrong PIN in a row blocks the vault. The web part no longer shows the list of entries; instead, it shows the Reset screen with the message "You've entered an incorrect PIN too many times." and a single Reset button. No other action is available, and the entries cannot be opened. Other pages and devices show this screen after loading the saved blocked state. A session that is already unlocked does not receive an immediate notification of this change.
What the reset does
Clicking Reset opens the Confirmation dialog with the text "Are you sure you want to reset your vault? This action will delete all your passwords stored in the vault." and the Cancel and Reset buttons. Only after you click Reset in this dialog is the vault file emptied:
- all entries - names, user names, passwords, URLs, notes, folders, tags and favorites - are deleted;
- the PIN and the failed-attempt counter are removed;
- the Set up PIN screen appears, and you start with an empty vault under a new PIN (see KB10442. How to Set Up Your PIN in Password Vault).
❗ Important
The reset cannot be undone in Password Vault. Before you click Reset, make sure you can restore access to the accounts stored in the vault in another way, for example through the password recovery of each service.
Before resetting, Password Vault reads the latest file again. If its failed-attempt counter is below five, it does not reset the vault and instead displays the current state. This can happen if a correct PIN was accepted before the block was recorded, or if the vault has already been reset elsewhere. If the reset cannot be saved, the screen shows the red error bar "Sorry, something went wrong. Please refresh the page and try again."
The vault is reset only from this screen: Password Vault has no command to reset the vault voluntarily.
No administrator unlock
The counter and the data used to verify the PIN live only in your vault file; the PIN itself is not stored anywhere. There is no unlock function for administrators, and Vitextra stores no copy of your vault, your PIN or a recovery key. Neither your Microsoft 365 administrator nor Vitextra support can unblock the vault, recover the PIN or restore the entries through Password Vault. Likewise, there is no way to recover a forgotten PIN; see KB10460. I Forgot My PIN in Password Vault: What Are My Options?.
How to avoid a blocked vault
- Note your PIN in a safe place.
- After two or three wrong attempts, stop and check that you are typing the right PIN instead of trying further combinations.
- Lock your computer when you leave it: anyone who can use your signed-in browser can enter wrong PINs, and five of them block your vault.
- Keep important credentials also in another place approved by your organization.
💡 Tip
If the vault is already blocked, see KB10461. Why Password Vault Is Blocked: "You've Entered an Incorrect PIN Too Many Times". For an overview of all protection layers, see KB10452. How Password Vault Protects Your Data: Encryption, PIN and Storage.
