Concepts

This page explains the ideas of Lasbolt. Read it once. The guides use these words without more explanation.

The picture

    flowchart TB
  U["Account<br/>username + master password"] --> D1["Device: web app"]
  U --> D2["Device: phone"]
  U --> D3["Device: CLI"]
  U --> P["Personal space"]
  U --> SS["Shared space"]
  T["Team"] --> SS
  P --> F1["Folder<br/>server-readable"]
  P --> F2["Folder<br/>end-to-end"]
  SS --> F3["Folder<br/>end-to-end"]
  F1 --> I1["Item: login"]
  F2 --> I2["Item: key"]
  A["Agent or script<br/>scoped key"] -. "scope" .-> F1
  A -. "grant" .-> F2

Account

An account is a username and a master password. You make it in the web app. Your device runs a slow key function (Argon2id) on the master password. The result gives two keys:

The auth key goes to the server to log in. The server hashes it again.
The encryption key stays on your device. It unlocks your private keys.

The server never gets your master password. If you forget it, only a recovery kit can bring back your end-to-end data.

The first account on a new server is the owner. Later accounts need an invitation, unless the owner opens registration. See First owner and users.

Vault, items and fields

Your vault is what you can open with your account. It holds items. An item is a login, a note, a card or a key (a login with no username).

An item has fields: text, secret text, a password, a URL, a one-time password (TOTP) secret. You can add custom fields. An item can also have metadata: facts that are not secret, such as the base URL of an API, the environment or the expiry date. Metadata lets an agent find the right secret without a permission to read it.

Folders: server-readable and end-to-end

Items live in folders. Each folder has one of two protection levels.

	Server-readable (default)	End-to-end (E2E)
The server can read the values	Yes, while it runs	No
Server search, API and agent read	Yes, in scope	No: only an unlocked client
Autofill	Yes	On an unlocked client
A stolen database or backup shows	Ciphertext (the server key is needed)	Ciphertext
A hacked running server shows	The data	Nothing (with a native client)
Recovery without the master password	An admin can reset access	Only with the recovery kit

E2E is a permanent, one-way choice for a folder and everything in it. You cannot move items out or convert the folder back. Moving an item into an E2E folder purges its server-readable history. Old backups can still hold the old plain copy until they expire.

Everything in an E2E folder is encrypted, also titles, URLs and field names. Only the name of the E2E root folder stays visible.

Spaces, members and roles

A space is a container for folders and the unit of sharing.

Each user has a personal space.
A shared space has members. Its folders are E2E. A member joins after a safety number check.

A space has its own roles. A role is the same word in each space.

Role	Gives
`use`	Fill and run with a secret. Cannot reveal it.
`reader`	Read.
`writer`	Read and change.
`admin`	Also manage members.
`owner`	Also add, change and remove other owners. The last owner cannot leave.

The server has instance roles too: owner, admin and member. They give power over the server (users, invitations, registration). They give no access to the content of a space.

Teams

A team is a group of users with its own key. You give a team a role in a space. A new team member gets the access of the team with one key step, not one for each space. See Teams.

Keys, in short

There are three layers.

Each user has a key pair for encryption and a key pair for signatures. The private parts are encrypted with your encryption key.
Each E2E folder has its own folder key pair. Each member gets the private part, sealed to the public key of that member.
Each item has a random item key. It encrypts the item. It is sealed to the folder key.

Two results follow. A person with write access can add items with only the public folder key: write without read. And adding a member needs one seal, not one for each item. The exact algorithms are on the Cryptography page.

Devices and sync

A device is a browser, an app or a CLI that signed in to your account. You see them in Settings > Devices and you can remove one. See Devices and approvals.

Every change is an operation in a log. The current state comes from the log. For each field, the latest change wins. The older value stays in the history. Deleted items go to the trash, and the history stays unless you purge it. Because the rule only compares time stamps, the server can merge E2E fields without reading them.

Each device keeps an encrypted local copy. It works offline and syncs when it can. Your own devices can also sync with each other without the server. See Peer sync.

Agents and scoped keys

Scripts and AI agents get limited access.

A session comes from lasbolt login. You approve it in the browser. It lasts 24 hours and is read-only by default.
A scoped key is a long-lived key for CI or an unattended agent. It has a name, a scope (spaces, folders, items; read or write), an expiry and an optional IP range.
A secret can ask for your approval for each use.
The agent gets references (lasbolt://space/folder/item/field), not values. lasbolt run puts the value into the environment of one program.

See AI agents.

Last updated on 2026-10-21

Quickstart