Frequently asked
questions

Your data is protected — but it cannot be recovered. Sanctum does not store your password or any password hint. If you forget your vault password, there is no way to access your vault contents. This is by design: a recovery mechanism would require storing something that could be used to regain access, which weakens the security model. Write your password down somewhere secure.

No. Sanctum is a fully local application. It makes no network requests, collects no analytics, and has no account system. The only network activity is from the built-in browser when you actively use it to browse websites.

No — and this is important to understand. The built-in browser protects your browsing data on your device. Cookies, history, and cached content are cleared when you lock the vault. However, Sanctum does not include a VPN. Your internet traffic is still visible to your network provider, employer network, router, or any monitoring software installed on your machine.

If you need network-level privacy, use a separate VPN service. Sanctum protects what is stored on your device, not what travels over your network.

Sanctum's isolation and clear-on-exit guarantees only apply to its own built-in browser. You can choose to open a saved bookmark in an installed browser of your choice — Chrome, Brave, Edge, or Firefox — but once it opens there, you've left Sanctum's session. From that point, your privacy depends on that browser's own private / incognito mode, not on Sanctum.

Yes, but your vault does not sync automatically — Sanctum is intentionally local-only. To use your vault on another machine, create a backup and restore it there. You'll need to keep backups up to date manually if you work across multiple devices.

No. Sanctum is free, so you can always download it again and restore your .pvbackup file with your vault password — there's no account or licence tying your backup to a specific install. A standalone recovery tool is also planned, so your backups will stay readable even without installing Sanctum at all.

Sanctum can import and encrypt any file type. For preview, it supports images, video, PDF, Word documents, plain text, Markdown, CSV, JSON, and a range of source and config file formats. Files with unsupported formats can still be imported and exported, but will open as read-only copies in your system's default application.

Your vault data on disk is always encrypted. Sanctum only holds the decryption key in memory while unlocked. If the application crashes, the key is lost from memory and the vault returns to its encrypted state on the next launch. Temporary decrypted files in the session folder are cleared on next launch.

Yes. The source code is available on GitHub. You can read it, build from it, and verify that the app does exactly what it says. The security model and cryptographic details are also documented openly in the repository.

Yes, completely. Sanctum has no dependency on any external service. The only exception is the built-in browser, which requires an internet connection to load websites — but the vault itself functions entirely offline.

Yes. Go to Settings → Storage → Delete all vault items. This requires your vault password to confirm. It removes all files, notes, bookmarks, passwords, folders, and tags while preserving your vault password and app settings. This action cannot be undone.

No. Sanctum is free to use with no time limit or feature restriction. On the donation page you'll find a suggested amount if you'd like to support development, but any amount — or none at all — is fine. You are never required to pay to use Sanctum.