Skip to content
Okashic Docs

Vault

The vault is the source of record for the essentials of who you are. Everything in it is end-to-end encrypted and private by default. You hold the keys; the cloud stores ciphertext it can’t read.

Records

The vault is made of records. Each record has a type that shapes its fields:

  • Logins — a service’s sign-in details: the credential, the domains it matches, and the operations allowed on it.
  • Secrets — passwords, API keys, TOTP seeds, and passkeys.
  • Personal data — your name, address, and contact details, alongside identity and documents. These are your own essentials; Okashic isn’t a contacts store for other people. Some fields are derived — a birthdate yields its month, day, year, and zodiac — so they can be filled and shared on their own.
  • Notes, cards, and documents — the rest of what belongs in one place you own.

Every record carries a stable id, a name, labels, and timestamps. The name, labels, and content are encrypted; only the id and metadata are what sync and merge work on.

Generate

Create a strong password or passphrase with the usual controls and save it straight to a record — the standard password-manager generator.

Organize records with types, labels, and folders, and mark favorites. Search runs locally over the decrypted records, so the server never sees your query or its results.

Files and folders

Alongside records, the vault holds files and folders. This is where your agent’s wiki and scripts live. A file is private by default; you can mark a folder as agent-accessible so the agents you’ve set up can read and write within it. It stays end-to-end encrypted either way — agent-accessible means read locally, not uploaded in the clear.

Folders can carry a retention window, so files meant to be temporary clean themselves up.

Import

Bring your existing data in from 1Password, Bitwarden, and other formats, so you can move without retyping. Import maps each external item onto an Okashic record and its type.

Sync

Each device holds a full copy. Sync between a device and the cloud can be full or incremental, and incremental sync is record-level: a change uploads only the records that changed. Edits to different records merge on their own. When the same record changes on two devices at once, both versions are kept and the conflict is surfaced for you to resolve, so nothing is silently dropped.