2026-05-22·8 min read

Encrypted Vault: Your Private SSH Credentials, Always Secure

Amir Karimov

When managing SSH connections, the biggest risk is the credentials you store. That's where SSH Bridge's Encrypted Vault comes in. It uses libsodium to encrypt all your sensitive data.

What Is the Encrypted Vault?

The Encrypted Vault is a local-only, end-to-end encrypted storage system built into SSH Bridge. It uses libsodium to encrypt all your sensitive data before it touches any network.

The Cryptography: libsodium

SSH Bridge uses libsodium (specifically the Dart sodium_sumo binding), which implements these proven algorithms: X25519, Box (AEAD), Sign (Ed25519), scrypt, and randombytes.

How the Vault Works

Step 1: Vault Creation

When you first set up the vault, SSH Bridge generates a random Box key pair, a random salt, and a master key derived from your password using scrypt.

Step 2: Unlocking the Vault

When you unlock the vault, your password is hashed with the stored salt, the derived key decrypts the encrypted private Box key, the system verifies the key pair matches, and the vault is unlocked.

Step 3: Encrypting an Item

When you save a password or key, a unique item key is generated, the item data is encrypted with that item key, and the item key is sealed with the vault's public key.

Step 4: Decryption

When you access stored data, the vault's private key unwraps the sealed item key, the item key decrypts the vault item, and the data is returned to your application.

Secure Storage

The vault data is stored using FlutterSecureStorage, which uses the platform's keychain on Android/iOS, Secure Enclave on macOS, and DPAPI on Windows.

Security Best Practices

Choose a Strong Master Password

Your master password is the only thing that protects your vault. Use at least 8 characters, mix uppercase/lowercase/numbers/symbols, and avoid common words.

Remember the Vault

SSH Bridge offers two modes: Remember Vault (keeps vault unlocked) and Don't Remember Vault (clears vault on logout).

Conclusion

The Encrypted Vault is your first line of defense against credential theft.