Install and unlock the extension

Setting up the extension takes four steps: install it from your browser’s store, sign in, register the device, and set a device-bound unlock. After that, day-to-day use is a quick biometric prompt rather than a password.

Install and sign in

1. Install from the browser store. Once VaultTerm is listed, add the extension from your browser’s store — Chrome Web Store, Edge Add-ons, or Firefox Add-ons.
2. Sign in. Open the popup and authenticate with your VaultTerm account.
3. Register the device. The extension registers this browser as a device on your account. This device is now individually listed and can be revoked on its own — see Settings and security dashboard.
4. Set a device-bound unlock. Enrol a biometric / WebAuthn resident key so the vault opens with a local credential instead of re-entering your password each time.

The device session

The extension does not keep a long-lived password. What it holds is a device session built on rotating refresh tokens, next to the encrypted vault copy on the device — a copy sealed under a server-issued key that is time-limited and revocable, and that also records what you may do in each vault so the extension can answer that with no connection. See Browser extension overview for what is in that copy, how an organization ends it, and what happens to a change you make while offline. The session itself works like this:

• Refresh tokens rotate. Each time the session refreshes, the old refresh token is retired and a new one is issued. A token is single-use for rotation.
• Reuse is detected. If a refresh token that has already been rotated (or revoked) is presented again, the broker treats it as reuse and refuses it. A stolen token on its own does not open the vault, and replaying an old one is caught rather than honoured.
• Spending refresh is gated. The extension only spends a refresh token once the unlock gate has been cleared, so day-to-day use of the browser does not silently reopen the vault.

How biometric unlock works

Biometric unlock is a local gate, not a server-verified ceremony. Being exact about this matters, because it decides what it protects you from and what it does not:

1. At enrolment the extension creates a WebAuthn credential scoped to its own extension origin, held by the platform authenticator (Touch ID, Windows Hello, or a device PIN).
2. To unlock, the extension runs a user-verification ceremony against that credential in a small focused window. The result is checked on the device. Nothing is registered with, or verified by, the broker, and the credential carries no secret.
3. Clearing the gate is what authorises the extension to spend its stored refresh token and restore the session.

So the gate stops someone who sits down at your unlocked browser and opens the popup. It is not what protects a stolen browser profile — that is the job of the refresh token itself, which is single-use with server-side reuse detection, revocable per device, and expires. Treat the gate as a convenience lock on the popup, and device revocation as the control that actually ends access.

Biometric unlock is opt-in, and “Sign in with password” always works. Offline, unlock is your account password rather than a biometric: a browser extension has no keychain to hold the cache key behind a fingerprint. See Browser extension overview for the offline copy.

How long offline unlock lasts

Offline unlock is set up when you sign in with your password, and it is not open-ended. Two things decide how long one password entry keeps it working.

A key renewal costs you nothing. While the device keeps in touch, the copy’s key is renewed quietly — the same key, pushed further out — and offline unlock is untouched.

A key replacement has to be carried, and the carry is bounded. When the key is replaced rather than renewed (it lapsed, or it was revoked, so the server mints a new one), offline unlock has to be re-anchored to the new key. The extension does that without asking for your password, so a replacement that happens while the browser is open does not lock you out. One password entry may carry offline unlock through two key replacements, or 45 days, whichever comes first. Entering your account password restarts both counts.

Past either bound, offline unlock is dropped rather than extended. Two things follow from that, and both are deliberate:

• Nothing is erased and no credential is lost. The popup reports that this browser cannot unlock offline; signing in once with a connection sets it up again.
• A browser that was closed at the moment of a replacement loses it the same way. The material that does the re-anchoring is held in memory only, for as long as the extension is unlocked, and it goes when the browser does. It is never written to disk, so a copy of the profile does not carry it.

The bound is what stops that in-memory material, captured once, following the key forward indefinitely. It is deliberately longer than one default key lifetime in both directions, so ordinary use never meets it.

Where to go next

• Settings and security dashboard — manage enrolled devices and review recent activity.
• Browser extension overview — what the extension does once it is unlocked.
• Roles and permissions — what a signed-in user can reach.