Credential Vault for Confluence
User Guide

Getting Started

Adding the vault to a page

1. Open any Confluence page and click Edit
2. Type /Credential Vault in the editor body
3. Select Credential Vault from the macro menu
4. Click Save or Publish the page

The vault macro can be added to any page. Each page has its own independent vault — with its own PIN, entries, templates, and settings.

Protecting the vault page

Anyone with edit access to the Confluence page can delete the page (and the vault macro along with it). Use Confluence-native protections:

• Page Restrictions: on the page, click the lock icon (or the more-actions menu → Restrictions). Set view and edit so only specific users or groups can change the page.
• Space Permissions: in Space Settings → Permissions, remove the "Delete Pages" permission from all users except admins and space admins. This protects every page in the space.

Creating Your PIN

The first time you open the vault on a new page, you will be prompted to create a PIN.

• Minimum 8 characters for new vaults — a live strength meter (Weak / Fair / Good / Strong) is shown as you type.
• Legacy vaults created with shorter PINs (4+ characters) can still unlock with their original PIN.
• Your PIN is used to derive your encryption key. It is never stored anywhere — only a salted SHA-256 hash is kept for verification.
• Write your PIN down before you continue — if you forget it, your credentials cannot be recovered.

Enter your PIN, confirm it, and click Create vault. The user who creates the vault becomes the vault owner.

The Vault Interface

+-------------------------------------------------------------+
|  Credential vault       [+ Add] [Archive] [Settings] [Lock] |
|  12 entries                                                  |
|  Auto-locks after 10 min of inactivity                       |
+-------------------------------------------------------------+
|  Search name, username, URL, category...        [x]          |
|  [All] [Work] [Personal] [Cloud]      Sort: A to Z           |
|  [Expand all] [Select] [Shortcuts]                           |
+-------------------------------------------------------------+
|  * GitHub             [DevOps]  [MFA]    [pin][dup][edit]    |
|    AWS Console        [Cloud]   [MFA]    [pin][dup][edit]    |
|    Personal Gmail     [Email]            [pin][dup][edit]    |
+-------------------------------------------------------------+

Header Controls

Ownership & Roles

Each vault has one owner, set automatically to the Atlassian account of the user who first creates it. Everyone else with page access is a regular user.

Owner-only actions appear in Settings for everyone but are disabled (greyed out) for regular users, with a small "Owner only" badge.

Adding Credentials

Click + Add in the header. You are first shown the templates picker — choose a template to pre-fill common fields, or click Blank.

Credential fields

Password Generator

Click Generate next to the password field for a crypto-random password. Configure defaults in Settings → Password Generator:

• Toggle character sets: A–Z, a–z, 0–9, symbols (#$!)
• Length slider from 8 to 99 characters (default 20)
• At least one character class must remain enabled

Password Strength Meter

Four coloured segments appear as you type: 🔴 Weak · 🟠 Fair · 🔵 Good · 🟢 Strong.

Checking for Known Breaches (Have I Been Pwned)

Click Check for breaches below the password field. Only the first 5 characters of a SHA-1 hash are sent to the Have I Been Pwned API (k-anonymity) — your actual password never leaves your browser.

• ✓ Not found — password does not appear in any known breach
• ⚠ Found in N breaches — you should change this password

Duplicate & password-reuse warnings

When saving, the vault shows a non-blocking warning if the entry's name or URL matches an existing entry, or if the password is already used by another entry. Tick "Don't warn me again on this device" to suppress duplicate warnings later.

Templates

Templates pre-fill the new-entry form with sensible defaults for common credential types — MSP-focused presets like M365 Admin, AWS Console, Windows RDP, Linux SSH, Firewall, Switch, Database, GitHub, and more.

Choosing a template

Click + Add → the Choose a template modal opens. Click any tile to start a new entry pre-filled from that template, or click Blank to start empty.

Managing shared templates (owner only)

Open Settings → Manage templates to add, edit, rename, change icon, or remove templates that everyone using the vault will see. Built-in templates can be reset back to defaults from this screen.

My view — personal templates & hidden tiles

From the Choose a template modal, click My view (top-right). Three tabs:

• Hidden: tick built-in templates you want hidden from your personal grid.
• My templates: create, edit, or delete templates only you see.
• Sort order: A to Z, Z to A, Team first, or Mine first.

Hidden templates and personal templates are stored in your browser's local storage — they follow your browser, not your Atlassian account.

Viewing & Using Credentials

Click any entry in the vault list to expand it. Opening an entry records a last used timestamp shown at the bottom of the expanded card.

MFA Codes & QR Re-Add

Store a TOTP secret to generate live 6-digit codes directly in the vault — no separate authenticator app needed.

Where to find your MFA secret

When enabling 2FA on any website, look near the QR code for a link that says "Can't scan the QR code?", "Enter setup key manually", or "Show secret key". That base32 string (e.g. JBSWY3DPEHPK3PXP) is your TOTP secret. Paste it into the MFA secret field. You can also paste a full otpauth:// URI — the vault parses digits, period, and algorithm from it.

MFA Countdown Timer

When an MFA secret is stored, a live 6-digit code displays with a countdown timer, a progress bar that turns amber at 10 seconds and red at 5, and auto-refresh every 30 seconds.

Re-add to Authenticator (QR code)

Click the QR-code button inside an expanded entry to open a printable QR code suitable for scanning into any standard authenticator app (Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden). The raw secret or otpauth:// URI is also shown below the QR code for manual entry.

Tags

Tags are freeform labels you can attach to any entry. Unlike categories (which come from a fixed list managed by the owner), tags are typed in by the user.

• Adding tags: in the entry form, type a tag and press Enter or comma. Tags are lower-cased automatically and spaces become hyphens (so "Prod Server" becomes prod-server).
• Searching tags: tags are searchable — the main search bar matches entry name, username, URL, category, notes, and tags.

Categories

Default categories: Work · Personal · Finance · Email · Cloud · Servers · Network · DevOps · Social · Other.

When entries have categories assigned, a row of category pills appears below the search bar. Click a category to filter the list; click All to return to the full list.

Managing categories (owner only)

Open Settings → Manage categories to add or remove categories, and drag-and-drop to reorder them. Changes apply immediately.

Search, Sort & Filter

Multi-chip search

• Type any text and press Enter to convert it into a search chip — this allows multiple search terms (AND logic).
• Backspace in an empty search input removes the last chip.
• Click the ✕ on a chip to remove it; click the main ✕ to clear everything.

Searches match against entry name, username, URL, category, notes, and tags.

Sort options

Pinned entries always appear at the top within the active sort.

Search chips, category filter, and sort all work together — only entries matching every active filter are shown, then sorted.

Pin, Duplicate, Edit, Archive

Each entry header shows these icon buttons on the right:

Timestamps

Each entry tracks four timestamps shown at the bottom of the expanded card: Created, Modified, Password changed, and Last used. Hover any timestamp for the full date and time. Timestamps are included in CSV exports.

Bulk Actions

Click Select in the toolbar to enter selection mode. A checkbox appears on every entry; tick the ones you want to act on.

• The toolbar shows Delete N (which archives the selected entries in bulk).
• Click Cancel to leave selection mode without changes.

Bulk delete moves entries to the Archive — they can be restored before they are auto-purged. Only the vault owner can permanently delete from the Archive.

Archive (Soft Delete)

Clicking the archive icon on an entry soft-deletes it — the entry is hidden from the main list but still encrypted and stored. You can restore it before it is auto-purged.

Opening the archive

When at least one entry is archived, an Archive button appears in the header showing the count. You can also reach it from Settings → View archive.

Restoring an archived entry

Click Restore. The entry returns to the main list with its Modified timestamp updated. If the name already exists on another live entry, "(restored)" is appended automatically.

Permanent deletion (owner only)

Inside the Archive, the owner sees a small red ✕ next to each entry. Clicking it permanently deletes the entry after a confirmation prompt. Regular users cannot hard-delete; the button is hidden for them.

Auto-delete after N days (owner only)

In Settings → Auto-delete after, the owner picks a retention window: Never, 7, 14, 30, 60, 90 (default), 180, or 365 days. When an entry's archive timestamp is older than this window, it is permanently and silently deleted the next time the vault is unlocked.

When you archive an entry while auto-delete is enabled, a one-time notice reminds you of the retention window. Tick "Don't warn me again on this device" to suppress it in future.

Password History

Whenever you change an entry's password, the previous password is added to that entry's password history. Up to the last 5 previous passwords are kept per entry, along with the date each was changed.

Viewing history

Inside an expanded entry, click the clock icon next to the password field to open the Password history modal. Each row shows when the password was changed, the masked password with a reveal toggle and a copy button, and a Restore button.

Restoring a previous password

Clicking Restore on a history row sets that old value back as the live password. The current password is pushed into history (so you can undo the restore). If the restored password was already in history, it is removed from the list since it is now active again.

Settings

Click the gear icon in the header to open the Settings panel.

Change PIN (owner only)

1. Open Settings → Change PIN
2. Enter your current PIN to verify
3. Enter and confirm your new PIN (minimum 8 characters)
4. Click Set new PIN

All entries are immediately re-encrypted with the new PIN and a fresh per-vault salt. The old PIN no longer works.

Auto-lock timeout (owner only)

Pick from 1, 3, 5, 10 (default), 15, 30, or 60 minutes. A 60-second countdown banner appears before locking (20 seconds for the 1-minute setting) with a Stay unlocked button.

Theme

Choose Light, Auto (follows your OS preference), or Dark. The setting is stored per browser, per user.

Activity Log

Open Settings → Activity log to see the most recent vault events. The log is PIN-protected on the server — opening it requires your PIN hash, so a user with page access but not the PIN cannot read it.

Events logged: vault_created, pin_change, add / edit / delete (with entry name), archive / restore / bulk_archive / archive_purge, csv_export / csv_import, ownership_transferred, restore_password.

Each row shows when, what, and who (display name plus account ID on hover). The log is capped at the most recent 2,000 events per vault. You can export the log to CSV from the modal footer.

Locking & Auto-Lock

Lock immediately

Click the lock icon in the header at any time. All decrypted credentials and the session key are cleared from memory; the lock screen returns.

Auto-lock

The vault automatically locks after the configured idle timeout (default 10 minutes). Idle means no mouse movement, keystrokes, scrolls, or touch events. A 60-second countdown banner is shown before locking, with a Stay unlocked button. The vault also locks when you navigate away from the page or refresh it.

Import & Export

Export to CSV (owner only)

1. Open Settings → Export to CSV
2. Read the security warning carefully
3. Click Download CSV to confirm

The export is generated entirely in your browser. Every export is recorded in the Activity log so other team members can see who exported and when.

CSV columns

Importing MFA secrets into another app

• Google Authenticator — + → Enter a setup key → paste
• Authy — Add account → Enter key manually → paste
• Microsoft Authenticator — + → Other account → Enter code manually
• 1Password — Edit item → Add field → One-Time Password → paste
• Bitwarden — Edit item → TOTP → paste

Import from CSV (owner only)

1. Open Settings → Import from CSV
2. Click Select CSV file
3. The vault parses the file and shows the entry count
4. Click Import N entries to merge them into the vault

Imported entries are merged — nothing is overwritten. The CSV must include at least the Name, Username, and Password columns. Unsafe URL protocols are silently stripped during import; the credential itself is still saved. On the free tier, an import is blocked if it would push you above the 3-entry cap.

Transfer Vault Ownership

The vault owner can hand off ownership to another Atlassian user on the same site — useful for staff handovers, account closures, or rotating duties.

1. Open Settings → Transfer vault ownership
2. Read the warning carefully — the change cannot be undone by you
3. Click Continue, search for the new owner by name, and select them
4. Click Transfer ownership

You lose owner-only rights immediately. The new owner can permanently delete entries from the Archive, change the PIN / idle timeout / archive retention, import and export CSV, manage shared templates and categories, and transfer ownership again. The event is recorded in the Activity log as ownership_transferred.

Recovery If You Forget Your PIN

Before you are locked out

1. If the owner is still logged in, open Settings → Change PIN and set a new PIN you will remember
2. The owner can export credentials via Settings → Export to CSV as a backup

If you have already forgotten your PIN

The encrypted credentials cannot be recovered. This is intentional — it means nobody else can recover them either, including Atlassian and CowboyMSP. The owner can recreate the vault on a new page and re-enter the credentials from any backup.

Prevention

• Store your vault PIN in your personal password manager (1Password, Bitwarden, LastPass)
• Keep a printed or written copy in a secure physical location
• Always heed the "write this down" warning on first setup and PIN changes
• Owners should export to CSV periodically and store the file securely

Plans & Licensing

When you reach the 3-entry free-tier cap, the + Add button is disabled until a licence is active. Existing entries can still be viewed, copied, edited, and archived — only adding new entries is blocked.

No data loss when a trial ends: if you exceed 3 entries during a trial and the trial ends, your entries are preserved and remain viewable, editable, and deletable.

Keyboard Shortcuts

When the vault is unlocked and no modal is open:

The toolbar also has a small ⌨ ? button that reveals this list inline.

Security Summary

Frequently Asked Questions

Can Atlassian read my credentials?

No. Credentials are encrypted in your browser using AES-GCM 256-bit before being sent to Forge storage. Only encrypted blobs reach Atlassian's servers. Without your PIN, the data cannot be decrypted — not by Atlassian, not by CowboyMSP.

What happens if I forget my PIN?

Your credentials cannot be recovered without the PIN. See Recovery. Always store your PIN in a personal password manager.

Can I change my PIN without losing data?

Yes. Open Settings → Change PIN. All entries are re-encrypted with the new PIN immediately. Owner only.

How does the breach check work?

Only the first 5 characters of a SHA-1 hash of your password are sent to the Have I Been Pwned API (k-anonymity). Your actual password and the full hash never leave your browser.

Can I use the vault on mobile?

Yes. The vault works in any modern browser, including Confluence's mobile browser experience.

Why does the MFA code sometimes show dashes?

The MFA secret stored for that entry is invalid or incorrectly formatted. Edit the entry and verify the secret is a valid base32 string with no spaces. You can also paste a full otpauth:// URI.

How do I give someone else access to the vault?

Give them the Confluence page URL and the vault PIN. They need Confluence page view access and the PIN to decrypt.

Can I have multiple vaults?

Yes — each Confluence page with the macro added has its own independent vault, PIN, entries, templates, and settings.

Is the CSV export encrypted?

No. The CSV is plain text for portability. Delete it after use. Every export is recorded in the Activity log.

What happens to deleted entries?

They go to the Archive (soft delete). The vault owner can permanently delete archived entries from there. Archived entries are also auto-deleted after the retention window you choose in Settings (default 90 days).

Can I recover an old password if I changed it?

Yes, if it is one of the last 5 passwords for that entry. Click the clock icon next to the password field in the expanded card to open Password history, then click Restore.

What's the difference between Categories and Tags?

Categories come from a fixed list managed by the vault owner. Tags are freeform per-entry labels typed by the user. Both are searchable.

How do I hand the vault over when someone leaves?

The current owner opens Settings → Transfer vault ownership and picks the new owner from the Confluence user search. The handover is immediate and audited.

Why is the Change PIN option greyed out for me?

You are a regular user, not the vault owner. PIN, auto-lock, archive retention, import, export, templates, and categories are owner-only. View, copy, add, edit, and archive remain available to everyone with the PIN.