Getting started
with Sanctum

Setting up your vault

When you open Sanctum for the first time, you will be asked to create a vault password. This password is the only key to your vault — choose something you will remember, because there is no recovery option if you forget it.

Your password is never stored anywhere. Sanctum uses it to derive an encryption key locally, which is kept only in memory while the vault is unlocked.

Importing files

Drag and drop files directly into the vault gallery, or use the import button to browse for files. Sanctum supports images, video, documents, and most common file types.

On import you can choose to have Sanctum securely delete the original file from its source location. This overwrites the file before deleting it, reducing the chance of recovery by forensic tools.

Duplicate files are detected automatically using SHA-256 hashing. If you import a file that already exists in your vault, Sanctum will ask whether to replace it, keep both, or skip.

Organising your vault

• Folders — create nested folders for any combination of files, bookmarks, and notes
• Tags — colour-coded tags shared across all object types
• Favourites — mark frequently accessed items
• Ratings — one to five stars for files and bookmarks
• Search — search across all vault content including tags

Using the private browser

The built-in browser runs in an isolated session completely separate from your system browser. Cookies, cache, and browsing history are cleared automatically when you lock or close the vault.

• Save images and video directly into your vault
• Capture a screenshot of any page and store it as an encrypted image
• Save a page as an encrypted bookmark, with its thumbnail captured automatically
• Access your saved passwords for the current domain

Or, opening bookmarks in major browsers

If you'd rather open a saved bookmark in your regular browser instead of Sanctum's built-in one, you can — Sanctum can hand the link off to an installed browser of your choice: Chrome, Brave, Edge, or Firefox.

One thing to know: once a bookmark opens this way, you've left Sanctum's isolated session. Privacy at that point depends entirely on that browser's own private/incognito mode, not on Sanctum. Sanctum's isolation and clear-on-exit guarantees apply only to its own built-in browser.

Locking your vault

When locked, all decrypted content is cleared from memory. Your vault data on disk remains fully encrypted.

• Lock hotkey — press the configured hotkey from anywhere on your system to instantly lock Sanctum
• Auto-lock — Sanctum locks automatically after a period of inactivity, configurable in Settings
• Lock on minimise — optionally lock whenever the window is minimised
• Lock on sleep — Sanctum locks when your computer sleeps or the screen locks

Backing up your vault

Go to Settings → Storage → Backup to create a .pvbackup file. This is a portable encrypted archive of your entire vault — files, notes, bookmarks, passwords, and metadata.

Keep your backup in a safe place. The backup is protected by the same vault password that was active when it was created. Because the entire file is encrypted, it's safe to store it wherever you'd store any other personal backup — an external drive, or even your own cloud storage like Dropbox or Google Drive.

To restore, go to Settings → Storage → Replace Restore and select your backup file.

Forgotten password

There is no password recovery in Sanctum. This is intentional — a recovery mechanism would require storing information about your password somewhere, which weakens the security model. If you forget your vault password, your vault contents cannot be recovered.

Keep your password somewhere safe, such as a physical note stored securely, or a trusted password manager for your system account.

Moving your vault to another machine

Your vault password on the new machine will be whatever password was active when the backup was created.

• Create a backup from Settings → Storage → Backup
• Install Sanctum on your new machine
• Use Settings → Storage → Replace Restore to restore from your backup file