diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index 967ca71..68d88b0 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -17,6 +17,7 @@ You should receive an acknowledgement within three business days. We will valida
 - By default, every session created by the current CLI encrypts terminal payloads between the CLI and browser. Cloudflare still receives frame opcodes and traffic/lifecycle metadata. Plaintext disclosure to the relay, nonce/key reuse that compromises confidentiality, acceptance of modified ciphertext, or cross-language key-derivation incompatibility is in scope. Older clients that predate default E2EE are unsupported and should be upgraded.
 - `--no-e2ee` is an explicit opt-out for compatibility or debugging. In that mode HTTPS/WSS protects each transport hop, but terminal payloads intentionally pass through Cloudflare in memory. Relay access to that plaintext is expected behavior and the CLI must label it clearly; accidental fallback from the default encrypted mode is in scope.
 - E2EE access remains a bearer capability. Possession of both the complete salted URL and its browser password intentionally grants decryption. Relay-side dropping, delaying, and replaying of valid ciphertext are documented protocol limits rather than confidentiality claims.
+- Session passwords are kept in a per-account session vault. The accounts service stores each password only sealed to the account's vault public key (ephemeral ECDH P-256, HKDF-SHA256, AES-256-GCM bound to the session id and recipient). The matching private key is stored encrypted under a random vault key, and the vault key is wrapped only by a 160-bit recovery key the service never receives. Any way for the accounts service, the relay, or a copy of the database to open a sealed password, the private key, or the vault key is in scope, as is substituting a vault public key without the browser or the CLI refusing it. Two points are trust-on-first-use by design: the first key seen for a colleague, and the account key a machine linked before the vault existed learns on its next session. The web app served by shell.online performs the unlock and is trusted to, as it is trusted with a typed session password.
 - The CLI generates an eight-character base64url password with 48 bits of entropy when no password is supplied. This is an explicit convenience/security tradeoff for task-bound shares, not a claim of passphrase-strength protection. `SHELL_ONLINE_E2EE_PASSWORD` accepts a longer unique password for sensitive or long-lived sessions; recipients should receive the URL and password through separate channels when appropriate.
 - Persistent state files and Docker state volumes intentionally contain the host credential, browser password, and E2EE key material. Files created by shell.online must be owner-only. A saved password cannot be changed in place because the stable URL and key are bound to it; password rotation creates new state and a new URL. Disclosure caused by publishing, broadly mounting, or backing up that state outside shell.online is not a product vulnerability.
 - Active-session records in the per-user local control directory intentionally retain the browser password so `shell list` can reconstruct usable access. The directory and records must remain owner-only and are deleted when their processes close.
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..b22cc5e
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,11 @@
+title = "shell.online"
+
+[extend]
+useDefault = true
+
+# Fixed cross-language test vectors for the session vault. The private keys
+# and passwords in them are throwaway values made for these tests alone, so a
+# scanner flagging them is a false positive. Nothing else is exempt.
+[allowlist]
+description = "Session vault test vectors"
+paths = ['''(^|/)internal/account/testdata/vault-share-v2-(go|browser)\.json$''']
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2e48d16..36f62d5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,34 @@ All notable user-visible changes are recorded here. Versions follow [Semantic Ve
 
 ## Unreleased
 
+### Added
+
+- A session vault. Every session's password is sealed to your account, so it
+  opens in any browser you unlock, including sessions started in a terminal.
+  Setting one up is a one-time step that shows a recovery key; shell.online
+  stores the vault sealed and cannot open it.
+- `shell` seals each encrypted session's password to your vault when it
+  registers the session, using the vault key the browser handed it at
+  `shell login`, and will not seal to a key that has changed since.
+
+### Changed
+
+- Sessions started from the browser use 128-bit passwords, since nobody types
+  them.
+- Sharing a session seals its password to the colleague's vault rather than
+  to one of their browsers, so it opens on every device they use. A colleague
+  whose vault key changed is confirmed before anything is sealed to them.
+- Signing out locks the vault in that browser.
+
+### Fixed
+
+- A stored password is no longer deleted when a frame fails to decrypt, which
+  could lose a browser-started session for good.
+- The browser's password cache drops the least recently used entry rather than
+  the oldest written.
+- Starting a session on a machine that cannot receive a password is refused,
+  instead of producing a session nobody can open.
+
 ## [0.11.3] — 2026-09-11
 
 ### Changed
diff --git a/app/server/app.test.ts b/app/server/app.test.ts
index 2fb2942..501683f 100644
--- a/app/server/app.test.ts
+++ b/app/server/app.test.ts
@@ -7,6 +7,7 @@ import { deferred } from "./lib/store-deferred";
 import type { Store } from "./lib/store";
 import { createVerifier, localKeySet } from "./lib/firebase-token";
 import { base64url, deriveChallenge } from "./lib/pkce";
+import { createVault, sealToAccount } from "../src/lib/vault-crypto";
 
 const PROJECT = "test-firebase-project";
 const REDIRECT = "http://127.0.0.1:51234/callback";
@@ -1156,6 +1157,33 @@ describe("session ownership and handoff", () => {
     expect(handed.body.session.assigneeUid).toBeUndefined();
   });
 
+  it("lets a colleague keep their own copy of a key, and nobody else's", async () => {
+    const { colleague } = await orgWithColleague();
+    const path = `/api/sessions/${session.id}/keys`;
+    const share = { sender_public_key: "BASE64_PUBLIC_KEY", sealed: "v2.BASE64_SEALED" };
+
+    const forOwner = await call("PUT", path, { auth: colleague, body: { shares: [{ uid: "uid-1", ...share }] } });
+    expect(forOwner.status).toBe(403);
+
+    /* A password they typed and saw work, sealed to their own vault. */
+    const own = await call("PUT", path, { auth: colleague, body: { shares: [{ uid: "uid-2", ...share }] } });
+    expect(own.status).toBe(200);
+    const listed = await call("GET", "/api/sessions", { auth: colleague });
+    expect(listed.body.sessions[0].keyShare).toMatchObject({ sealed: "v2.BASE64_SEALED" });
+  });
+
+  it("tells the owner, and only the owner, who holds a copy", async () => {
+    const { colleague } = await orgWithColleague();
+    await call("PUT", `/api/sessions/${session.id}/keys`, {
+      auth: await idToken(),
+      body: { shares: [{ uid: "uid-2", sender_public_key: "K", sealed: "S" }] },
+    });
+    const owner = await call("GET", "/api/sessions", { auth: await idToken() });
+    expect(owner.body.sessions[0].sharedWith).toEqual(["uid-2"]);
+    const other = await call("GET", "/api/sessions", { auth: colleague });
+    expect(other.body.sessions[0].sharedWith).toBeUndefined();
+  });
+
   it("lets only the owner share a session key, and only with current members", async () => {
     const { colleague } = await orgWithColleague();
     const path = `/api/sessions/${session.id}/keys`;
@@ -1174,7 +1202,11 @@ describe("session ownership and handoff", () => {
       sealed: "BASE64_SEALED_PASSWORD",
     });
 
-    const overwritten = await call("PUT", path, { auth: colleague, body: { shares } });
+    /* A colleague may keep their own copy, but cannot write one for anyone else. */
+    const overwritten = await call("PUT", path, {
+      auth: colleague,
+      body: { shares: [{ ...shares[0], uid: "uid-1" }] },
+    });
     expect(overwritten.status).toBe(403);
 
     const outsider = await call("PUT", path, {
@@ -1719,3 +1751,160 @@ describe("inviting someone by email", () => {
     expect(sent[0].html).toMatch(/Join [^<]*<\/a>/);
   });
 });
+
+describe("session vault", () => {
+  const session = {
+    id: "qN7wKb3xTm9Ld2Ravh4YsPcE8UjZgF6t",
+    share_url: "https://shell.online/s/qN7wKb3xTm9Ld2Ravh4YsPcE8UjZgF6t#salt=AAAAAAAAAAAAAAAAAAAAAA",
+    command: "claude",
+    encrypted: true,
+  };
+
+  async function vaultBody(uid = "uid-1") {
+    const made = await createVault(uid);
+    return {
+      made,
+      body: {
+        public_key: made.bundle.publicKey,
+        encrypted_private_key: made.bundle.encryptedPrivateKey,
+        recovery_wrap: made.bundle.recoveryWrap,
+      },
+    };
+  }
+
+  /* A token from a sign-in that just happened, which is what a reset asks for. */
+  const freshSignIn = (claims: Record<string, unknown> = {}) =>
+    idToken({ auth_time: Math.floor(Date.now() / 1000), ...claims });
+
+  it("has none until one is set up", async () => {
+    const result = await call("GET", "/api/vault", { auth: await idToken() });
+    expect(result).toMatchObject({ status: 200, body: { vault: null } });
+  });
+
+  it("keeps the vault it is given and hands it back whole", async () => {
+    const { body } = await vaultBody();
+    const created = await call("POST", "/api/vault", { auth: await idToken(), body });
+    expect(created.status).toBe(201);
+    const fetched = await call("GET", "/api/vault", { auth: await idToken() });
+    expect(fetched.body.vault).toMatchObject({
+      publicKey: body.public_key,
+      encryptedPrivateKey: body.encrypted_private_key,
+      recoveryWrap: body.recovery_wrap,
+      version: 1,
+    });
+  });
+
+  it("will not overwrite a vault by setting one up again", async () => {
+    await call("POST", "/api/vault", { auth: await idToken(), body: (await vaultBody()).body });
+    const again = await call("POST", "/api/vault", { auth: await idToken(), body: (await vaultBody()).body });
+    expect(again.status).toBe(409);
+  });
+
+  it("refuses a vault that is not shaped like one", async () => {
+    const { body } = await vaultBody();
+    const result = await call("POST", "/api/vault", {
+      auth: await idToken(),
+      body: { ...body, recovery_wrap: "too-short" },
+    });
+    expect(result.status).toBe(400);
+  });
+
+  it("keeps each person's vault to themselves", async () => {
+    await call("POST", "/api/vault", { auth: await idToken(), body: (await vaultBody()).body });
+    const other = await call("GET", "/api/vault", { auth: await idToken({ sub: "uid-2" }) });
+    expect(other.body.vault).toBeNull();
+  });
+
+  /*
+   * A reset puts a new key where colleagues and machines seal passwords, so a
+   * token that has merely been refreshed must not be enough for it.
+   */
+  it("refuses a reset without a recent sign-in", async () => {
+    await call("POST", "/api/vault", { auth: await idToken(), body: (await vaultBody()).body });
+    const stale = await call("POST", "/api/vault", {
+      auth: await idToken({ auth_time: Math.floor(Date.now() / 1000) - 3600 }),
+      body: { ...(await vaultBody()).body, replace_version: 1 },
+    });
+    expect(stale).toMatchObject({ status: 403, body: { reauthenticate: true } });
+    const unknown = await call("POST", "/api/vault", {
+      auth: await idToken(),
+      body: { ...(await vaultBody()).body, replace_version: 1 },
+    });
+    expect(unknown.status).toBe(403);
+  });
+
+  it("replaces the vault on a reset from a fresh sign-in, and counts it", async () => {
+    await call("POST", "/api/vault", { auth: await idToken(), body: (await vaultBody()).body });
+    const { body } = await vaultBody();
+    const reset = await call("POST", "/api/vault", {
+      auth: await freshSignIn(),
+      body: { ...body, replace_version: 1 },
+    });
+    expect(reset.status).toBe(200);
+    expect(reset.body.vault).toMatchObject({ publicKey: body.public_key, version: 2 });
+  });
+
+  it("refuses to reset a vault that changed since the page loaded", async () => {
+    await call("POST", "/api/vault", { auth: await idToken(), body: (await vaultBody()).body });
+    const reset = await call("POST", "/api/vault", {
+      auth: await freshSignIn(),
+      body: { ...(await vaultBody()).body, replace_version: 4 },
+    });
+    expect(reset.status).toBe(409);
+  });
+
+  it("tells a linked machine which key to seal to, once there is one", async () => {
+    const tokens = await login();
+    const before = await call("GET", "/api/account/key", { auth: tokens.access_token });
+    expect(before.status).toBe(404);
+
+    const { body } = await vaultBody();
+    await call("POST", "/api/vault", { auth: await idToken(), body });
+    const after = await call("GET", "/api/account/key", { auth: tokens.access_token });
+    expect(after.body).toEqual({ public_key: body.public_key, version: 1 });
+  });
+
+  it("does not hand the key to a caller that is not a linked machine", async () => {
+    const result = await call("GET", "/api/account/key", { auth: await idToken() });
+    expect(result.status).toBe(401);
+  });
+
+  it("keeps the CLI's sealed copy of a password as the owner's", async () => {
+    const tokens = await login();
+    const { made, body } = await vaultBody();
+    await call("POST", "/api/vault", { auth: await idToken(), body });
+    const share = await sealToAccount(made.bundle.publicKey, session.id, "uid-1", "Kw9eHbru");
+
+    const registered = await call("POST", "/api/sessions", {
+      auth: tokens.access_token,
+      body: { ...session, owner_share: { sender_public_key: share.senderPublicKey, sealed: share.sealed } },
+    });
+    expect(registered.status).toBe(201);
+
+    const listed = await call("GET", "/api/sessions", { auth: await idToken() });
+    expect(listed.body.sessions[0].keyShare).toMatchObject(share);
+  });
+
+  it("still registers a session whose sealed copy is not shaped like one", async () => {
+    const tokens = await login();
+    const registered = await call("POST", "/api/sessions", {
+      auth: tokens.access_token,
+      body: { ...session, owner_share: { sender_public_key: "junk", sealed: "junk" } },
+    });
+    expect(registered.status).toBe(201);
+    const listed = await call("GET", "/api/sessions", { auth: await idToken() });
+    expect(listed.body.sessions[0].keyShare).toBeUndefined();
+  });
+
+  it("gives colleagues each member's vault key to seal to", async () => {
+    const invite = await call("POST", "/api/org/invites", { auth: await idToken(), body: { role: "member" } });
+    const colleague = await idToken({ sub: "uid-2", email: "colleague@example.com" });
+    await call("GET", `/api/org?invite=${invite.body.invite.id}`, { auth: colleague });
+    const { body } = await vaultBody("uid-2");
+    await call("POST", "/api/vault", { auth: colleague, body });
+
+    const listed = await call("GET", "/api/sessions", { auth: await idToken() });
+    const member = listed.body.members.find((entry: { uid: string }) => entry.uid === "uid-2");
+    expect(member.accountKey).toBe(body.public_key);
+  });
+});
diff --git a/app/server/app.ts b/app/server/app.ts
index 947b6fc..089a841 100644
--- a/app/server/app.ts
+++ b/app/server/app.ts
@@ -19,6 +19,7 @@ import {
   sessionSource,
 } from "./lib/sessions";
 import { mintSecret } from "./lib/tokens";
+import { RESET_SIGN_IN_WINDOW_MS, readOwnerShare, readVaultInput, vaultForApi } from "./lib/vault";
 import {
   changeRole,
   createInvite,
@@ -142,6 +143,19 @@ function ownsSession(membership: Membership, session: { ownerUid?: string; uid:
   return (session.ownerUid ?? session.uid) === membership.uid;
 }
 
+/*
+ * Who besides the owner holds a sealed copy of a session's password. Told to
+ * the owner only: it is theirs to know, and the service knows it anyway
+ * because it stores the copies.
+ */
+function sharedWith(
+  membership: Membership,
+  session: { ownerUid?: string; uid: string; keyShares?: { uid: string }[] },
+): string[] | undefined {
+  if (!ownsSession(membership, session)) return undefined;
+  return (session.keyShares ?? []).map((share) => share.uid).filter((uid) => uid !== membership.uid);
+}
+
 /**
  * The harnesses a polling agent claims, keeping only the recognised ones.
  *
@@ -580,6 +594,87 @@ export function createApp(options: AppOptions) {
         return;
       }
 
+      /* ---- Session vault ---- */
+
+      /*
+       * A vault is a public key and two pieces of ciphertext. Its owner gets it
+       * back whole, since none of it opens without the recovery key, and
+       * nobody else gets any of it but the public key.
+       */
+      if (route === "GET /api/vault") {
+        const identity = await requireUser(request);
+        if (!identity) return send(response, 401, { error: "sign in first" });
+        const key = await store.accountKey(identity.uid);
+        return send(response, 200, { vault: key ? vaultForApi(key) : null });
+      }
+
+      if (route === "POST /api/vault") {
+        const identity = await requireUser(request);
+        if (!identity) return send(response, 401, { error: "sign in first" });
+        const input = await readVaultInput((await readBody(request)) as Record<string, unknown>);
+        if (!input.ok) return send(response, 400, { error: input.reason });
+        const { publicKey, encryptedPrivateKey, recoveryWrap, replaceVersion } = input.value;
+        const now = Date.now();
+
+        if (replaceVersion === undefined) {
+          const created = await store.putAccountKey({
+            uid: identity.uid,
+            publicKey,
+            encryptedPrivateKey,
+            recoveryWrap,
+            version: 1,
+            createdAt: now,
+            updatedAt: now,
+          });
+          if (!created) return send(response, 409, { error: "this account already has a vault" });
+          const stored = await store.accountKey(identity.uid);
+          return send(response, 201, { vault: stored ? vaultForApi(stored) : null });
+        }
+
+        /*
+         * A reset puts a new key where colleagues and machines seal passwords,
+         * so a token that has only been refreshed is not enough for it. The
+         * person has to have signed in recently.
+         */
+        if (!identity.authTime || now - identity.authTime > RESET_SIGN_IN_WINDOW_MS) {
+          return send(response, 403, {
+            error: "Resetting your vault needs a recent sign-in. Sign out, sign back in, and reset within ten minutes.",
+            reauthenticate: true,
+          });
+        }
+        const existing = await store.accountKey(identity.uid);
+        const stale = { error: "Your vault changed since this page loaded. Reload and try again." };
+        if (!existing || existing.version !== replaceVersion) return send(response, 409, stale);
+        const replaced = await store.putAccountKey(
+          {
+            uid: identity.uid,
+            publicKey,
+            encryptedPrivateKey,
+            recoveryWrap,
+            version: existing.version + 1,
+            createdAt: existing.createdAt,
+            updatedAt: now,
+          },
+          existing.version,
+        );
+        if (!replaced) return send(response, 409, stale);
+        const stored = await store.accountKey(identity.uid);
+        return send(response, 200, { vault: stored ? vaultForApi(stored) : null });
+      }
+
+      /*
+       * What a machine seals its sessions' passwords to. The CLI pins the key
+       * it was given when it signed in, and uses this only to notice a change
+       * or to learn a key it was never given.
+       */
+      if (route === "GET /api/account/key") {
+        const token = await requireCli(request);
+        if (!token) return send(response, 401, { error: "not signed in" });
+        const key = await store.accountKey(token.uid);
+        if (!key) return send(response, 404, { error: "no vault" });
+        return send(response, 200, { public_key: key.publicKey, version: key.version });
+      }
+
       /* ---- Session registry ---- */
       if (route === "POST /api/sessions") {
         const token = await requireCli(request);
@@ -603,6 +698,20 @@ export function createApp(options: AppOptions) {
           deviceId: token.id,
         });
         if (!result.ok) return send(response, 400, { error: result.reason });
+        /*
+         * The CLI's own copy of the password, sealed to this account's vault,
+         * so the web app can open the session without asking anyone to type
+         * it. Optional and opaque: one that is not shaped like a share is
+         * dropped, and never allowed to fail the registration.
+         */
+        const ownerShare = result.session.encrypted && result.session.orgId
+          ? await readOwnerShare(body.owner_share)
+          : null;
+        if (ownerShare && result.session.orgId) {
+          await store.putKeyShares(result.session.orgId, result.session.id, [
+            { uid: token.uid, ...ownerShare },
+          ]);
+        }
         /* Only on first sight, so a persistent session restarting is silent. */
         if (result.isNew && membership) {
           await notifySessionStarted(
@@ -687,7 +796,12 @@ export function createApp(options: AppOptions) {
          */
         const sessions = (await store.listOrgSessions(membership.orgId)).map((session) => {
           const mine = session.keyShares?.find((share) => share.uid === membership.uid);
-          return { ...sessionForApi(session), keyShares: undefined, keyShare: mine };
+          return {
+            ...sessionForApi(session),
+            keyShares: undefined,
+            keyShare: mine,
+            sharedWith: sharedWith(membership, session),
+          };
         });
         return send(response, 200, {
           sessions,
@@ -702,9 +816,13 @@ export function createApp(options: AppOptions) {
         if (!membership) return send(response, 401, { error: "sign in first" });
         const session = await store.sessionInOrg(membership.orgId, shareRoute[1]);
         if (!session) return send(response, 404, { error: "no such session" });
-        if (!ownsSession(membership, session)) {
-          return send(response, 403, { error: "only the session owner can share its key" });
-        }
+        /*
+         * The owner shares with colleagues. Anyone else may keep only their
+         * own copy: a password they typed and saw work, sealed to their own
+         * vault so they need not type it again. That grants them nothing they
+         * did not already hold.
+         */
+        const isOwner = ownsSession(membership, session);
 
         const body = (await readBody(request)) as Record<string, unknown>;
         const incoming = Array.isArray(body.shares) ? body.shares : [];
@@ -729,6 +847,9 @@ export function createApp(options: AppOptions) {
         )) {
           return send(response, 400, { error: "invalid key share" });
         }
+        if (!isOwner && shares.some((share) => share.uid !== membership.uid)) {
+          return send(response, 403, { error: "only the session owner can share its key" });
+        }
 
         const memberIds = new Set((await store.members(membership.orgId)).map((member) => member.uid));
         if (shares.some((share) => !memberIds.has(share.uid))) {
@@ -966,7 +1087,12 @@ export function createApp(options: AppOptions) {
         if (!session) return send(response, 404, { error: "no such session" });
         const mine = session.keyShares?.find((share) => share.uid === membership.uid);
         return send(response, 200, {
-          session: { ...sessionForApi(session), keyShares: undefined, keyShare: mine },
+          session: {
+            ...sessionForApi(session),
+            keyShares: undefined,
+            keyShare: mine,
+            sharedWith: sharedWith(membership, session),
+          },
           members: await store.members(membership.orgId),
           you: membership,
           comments: await store.comments(membership.orgId, oneSession[1]),
diff --git a/app/server/lib/firebase-token.ts b/app/server/lib/firebase-token.ts
index c1a2ec9..5503bf4 100644
--- a/app/server/lib/firebase-token.ts
+++ b/app/server/lib/firebase-token.ts
@@ -7,6 +7,12 @@ export interface Identity {
   uid: string;
   email: string;
   name: string;
+  /**
+   * When this person last actually signed in, in milliseconds. A refreshed
+   * token keeps the original time, so this is how an operation that deserves
+   * a fresh sign-in can ask for one.
+   */
+  authTime?: number;
 }
 
 export type VerifyResult =
@@ -51,6 +57,7 @@ export function createVerifier(projectId: string, keys?: KeyLookup) {
         uid,
         email: typeof payload.email === "string" ? payload.email : "",
         name: typeof payload.name === "string" ? payload.name : "",
+        authTime: typeof payload.auth_time === "number" ? payload.auth_time * 1000 : undefined,
       },
     };
   };
diff --git a/app/server/lib/migrations/007_account_keys.sql b/app/server/lib/migrations/007_account_keys.sql
new file mode 100644
index 0000000..fca96bb
--- /dev/null
+++ b/app/server/lib/migrations/007_account_keys.sql
@@ -0,0 +1,19 @@
+-- A person's session vault.
+--
+-- Every session password is sealed to one key pair per account, so it outlives
+-- the browser that first held it. The public key is what colleagues and the
+-- CLI seal to. The private key is kept here only encrypted under a vault key,
+-- and the vault key only wrapped under a recovery key this service never
+-- receives. None of these columns opens anything by itself.
+--
+-- `version` counts resets. A reset replaces the key pair outright, and the
+-- version is how a write says which vault it means to replace.
+CREATE TABLE IF NOT EXISTS account_keys (
+  uid                    TEXT    PRIMARY KEY,
+  public_key             TEXT    NOT NULL,
+  encrypted_private_key  TEXT    NOT NULL,
+  recovery_wrap          TEXT    NOT NULL,
+  version                INTEGER NOT NULL,
+  created_at             BIGINT  NOT NULL,
+  updated_at             BIGINT  NOT NULL
+);
diff --git a/app/server/lib/orgs.ts b/app/server/lib/orgs.ts
index 110e4c3..1d82d53 100644
--- a/app/server/lib/orgs.ts
+++ b/app/server/lib/orgs.ts
@@ -29,6 +29,12 @@ export interface Membership {
    * password to them. Absent until they have signed in somewhere.
    */
   publicKey?: string;
+  /**
+   * Their session vault's public key, once they have set one up. Session
+   * passwords shared with them are sealed to this, so every browser they
+   * unlock can open them. Read from the vault, never written through here.
+   */
+  accountKey?: string;
 }
 
 export interface Invite {
diff --git a/app/server/lib/store-conformance.test.ts b/app/server/lib/store-conformance.test.ts
index 0dc1805..31294ff 100644
--- a/app/server/lib/store-conformance.test.ts
+++ b/app/server/lib/store-conformance.test.ts
@@ -128,6 +128,7 @@ function notification(overrides: Partial<Notification> = {}): Notification {
 type Implementation = { name: string; open: () => Promise<Store>; reset: (store: Store) => Promise<void> };
 
 const TABLES = [
+  "account_keys",
   "session_key_shares",
   "sessions",
   "agent_commands",
@@ -452,6 +453,57 @@ for (const implementation of implementations) {
       });
     });
 
+    describe("session vault", () => {
+      type AccountKey = Parameters<Store["putAccountKey"]>[0];
+
+      function vault(overrides: Partial<AccountKey> = {}): AccountKey {
+        return {
+          uid: "uid-1",
+          publicKey: "pk-1",
+          encryptedPrivateKey: "enc-1",
+          recoveryWrap: "wrap-1",
+          version: 1,
+          createdAt: 1000,
+          updatedAt: 1000,
+          ...overrides,
+        };
+      }
+
+      /* Two browsers setting up at once must not both believe they won. */
+      it("creates a vault once and refuses a second", async () => {
+        expect(await store.putAccountKey(vault())).toBe(true);
+        expect(await store.putAccountKey(vault({ publicKey: "pk-2" }))).toBe(false);
+        expect(await store.accountKey("uid-1")).toEqual(vault());
+      });
+
+      it("replaces a vault only at the version the reset expects", async () => {
+        await store.putAccountKey(vault());
+        const next = vault({ publicKey: "pk-2", version: 2, updatedAt: 2000 });
+        expect(await store.putAccountKey(next, 5)).toBe(false);
+        expect(await store.putAccountKey(next, 1)).toBe(true);
+        expect(await store.accountKey("uid-1")).toEqual(next);
+        /* The same reset replayed finds the version has moved on. */
+        expect(await store.putAccountKey(vault({ publicKey: "pk-3", version: 2 }), 1)).toBe(false);
+      });
+
+      it("does not replace a vault that does not exist", async () => {
+        expect(await store.putAccountKey(vault(), 1)).toBe(false);
+        expect(await store.accountKey("uid-1")).toBeNull();
+      });
+
+      it("hands out each member's vault key with the roster, and only theirs", async () => {
+        await store.putOrganization(organization());
+        await store.putMembership(membership());
+        await store.putMembership(
+          membership({ uid: "uid-2", email: "bo@example.com", role: "member", joinedAt: 2000 }),
+        );
+        await store.putAccountKey(vault({ uid: "uid-2", publicKey: "pk-bo" }));
+        const roster = await store.members("org_1");
+        expect(roster.find((entry) => entry.uid === "uid-2")?.accountKey).toBe("pk-bo");
+        expect(roster.find((entry) => entry.uid === "uid-1")?.accountKey).toBeUndefined();
+      });
+    });
+
     describe("agent commands", () => {
       it("hands queued work out exactly once", async () => {
         await store.putCommand(command());
diff --git a/app/server/lib/store-memory.ts b/app/server/lib/store-memory.ts
index 8eec4fe..7ab6385 100644
--- a/app/server/lib/store-memory.ts
+++ b/app/server/lib/store-memory.ts
@@ -4,6 +4,7 @@ import { dirname, join } from "node:path";
 import type { Invite, Membership, Organization, Role } from "./orgs";
 import type { AuditPage, AuditPageQuery, Store } from "./store";
 import type {
+  AccountKey,
   AgentCommand,
   AuditEvent,
   AuthorizationCode,
@@ -46,12 +47,13 @@ interface Shape {
   audit: AuditEvent[];
   comments: Comment[];
   notifications: Notification[];
+  accountKeys: AccountKey[];
 }
 
 const EMPTY: Shape = {
   codes: [], tokens: [], sessions: [], commands: [],
   organizations: [], memberships: [], invites: [], audit: [],
-  comments: [], notifications: [],
+  comments: [], notifications: [], accountKeys: [],
 };
 
 /**
@@ -114,6 +116,7 @@ export class MemoryStore implements Store {
         audit: parsed.audit ?? [],
         comments: parsed.comments ?? [],
         notifications: parsed.notifications ?? [],
+        accountKeys: parsed.accountKeys ?? [],
       };
     } catch {
       return structuredClone(EMPTY);
@@ -224,6 +227,24 @@ export class MemoryStore implements Store {
     return true;
   }
 
+  async accountKey(uid: string): Promise<AccountKey | null> {
+    const found = this.data.accountKeys.find((entry) => entry.uid === uid);
+    return found ? { ...found } : null;
+  }
+
+  async putAccountKey(key: AccountKey, expectedVersion?: number): Promise<boolean> {
+    const index = this.data.accountKeys.findIndex((entry) => entry.uid === key.uid);
+    if (expectedVersion === undefined) {
+      if (index >= 0) return false;
+      this.data.accountKeys.push({ ...key });
+    } else {
+      if (index < 0 || this.data.accountKeys[index].version !== expectedVersion) return false;
+      this.data.accountKeys[index] = { ...key };
+    }
+    this.flush();
+    return true;
+  }
+
   /** Records that `shell agent` is polling, and what it publishes about itself. */
   async markAgentSeen(
     id: string,
@@ -455,7 +476,12 @@ export class MemoryStore implements Store {
   async members(orgId: string): Promise<Membership[]> {
     return this.data.memberships
       .filter((entry) => entry.orgId === orgId)
-      .sort(byTime((entry) => entry.joinedAt, (entry) => entry.uid));
+      .sort(byTime((entry) => entry.joinedAt, (entry) => entry.uid))
+      .map((entry) => {
+        /* Each member's vault key rides along, so a password can be sealed to it. */
+        const accountKey = this.data.accountKeys.find((key) => key.uid === entry.uid)?.publicKey;
+        return accountKey ? { ...entry, accountKey } : entry;
+      });
   }
 
   async removeMember(orgId: string, uid: string): Promise<boolean> {
diff --git a/app/server/lib/store-postgres.ts b/app/server/lib/store-postgres.ts
index 772c193..8698a14 100644
--- a/app/server/lib/store-postgres.ts
+++ b/app/server/lib/store-postgres.ts
@@ -6,6 +6,7 @@ import pg from "pg";
 import type { Invite, Membership, Organization, Role } from "./orgs";
 import type { AuditPage, AuditPageQuery, Store } from "./store";
 import type {
+  AccountKey,
   AgentCommand,
   AuditEvent,
   AuthorizationCode,
@@ -213,9 +214,22 @@ function toMembership(row: Row): Membership {
     role: row.role,
     joinedAt: row.joined_at,
     publicKey: row.public_key,
+    accountKey: row.account_key,
   }) as unknown as Membership;
 }
 
+function toAccountKey(row: Row): AccountKey {
+  return {
+    uid: row.uid as string,
+    publicKey: row.public_key as string,
+    encryptedPrivateKey: row.encrypted_private_key as string,
+    recoveryWrap: row.recovery_wrap as string,
+    version: row.version as number,
+    createdAt: row.created_at as number,
+    updatedAt: row.updated_at as number,
+  };
+}
+
 function toInvite(row: Row): Invite {
   return defined({
     id: row.id,
@@ -812,6 +826,35 @@ export class PostgresStore implements Store {
     return true;
   }
 
+  /* ---- Session vault ---- */
+
+  async accountKey(uid: string): Promise<AccountKey | null> {
+    const row = await this.row("SELECT * FROM account_keys WHERE uid = $1", [uid]);
+    return row ? toAccountKey(row) : null;
+  }
+
+  /*
+   * Each branch is one conditional statement, so no other request can land
+   * between the check and the write.
+   */
+  async putAccountKey(key: AccountKey, expectedVersion?: number): Promise<boolean> {
+    const result = expectedVersion === undefined
+      ? await this.pool.query(
+          `INSERT INTO account_keys
+             (uid, public_key, encrypted_private_key, recovery_wrap, version, created_at, updated_at)
+           VALUES ($1, $2, $3, $4, $5, $6, $7)
+           ON CONFLICT (uid) DO NOTHING`,
+          [key.uid, key.publicKey, key.encryptedPrivateKey, key.recoveryWrap, key.version, key.createdAt, key.updatedAt],
+        )
+      : await this.pool.query(
+          `UPDATE account_keys
+           SET public_key = $2, encrypted_private_key = $3, recovery_wrap = $4, version = $5, updated_at = $6
+           WHERE uid = $1 AND version = $7`,
+          [key.uid, key.publicKey, key.encryptedPrivateKey, key.recoveryWrap, key.version, key.updatedAt, expectedVersion],
+        );
+    return (result.rowCount ?? 0) > 0;
+  }
+
   /* ---- Agent commands ---- */
 
   async putCommand(command: AgentCommand): Promise<void> {
@@ -1003,8 +1046,11 @@ export class PostgresStore implements Store {
   }
 
   async members(orgId: string): Promise<Membership[]> {
+    /* Each member's vault key rides along, so a password can be sealed to it. */
     const rows = await this.rows(
-      'SELECT * FROM memberships WHERE org_id = $1 ORDER BY joined_at ASC, uid COLLATE "C" ASC',
+      `SELECT m.*, a.public_key AS account_key
+       FROM memberships m LEFT JOIN account_keys a ON a.uid = m.uid
+       WHERE m.org_id = $1 ORDER BY m.joined_at ASC, m.uid COLLATE "C" ASC`,
       [orgId],
     );
     return rows.map(toMembership);
diff --git a/app/server/lib/store.ts b/app/server/lib/store.ts
index 5343516..904a177 100644
--- a/app/server/lib/store.ts
+++ b/app/server/lib/store.ts
@@ -1,5 +1,6 @@
 import type { Invite, Membership, Organization, Role } from "./orgs";
 import type {
+  AccountKey,
   AgentCommand,
   AuditEvent,
   AuthorizationCode,
@@ -100,6 +101,16 @@ export interface Store {
   deleteSession(orgId: string, id: string): Promise<boolean>;
   putKeyShares(orgId: string, sessionId: string, shares: SessionKeyShare[]): Promise<boolean>;
 
+  /* ---- Session vault ---- */
+  accountKey(uid: string): Promise<AccountKey | null>;
+  /**
+   * Writes a vault. Without `expectedVersion` it only creates one, and fails
+   * if one exists; with it, it replaces only the vault at that version. False
+   * means the condition failed, so two browsers setting up at once cannot both
+   * believe they won, and a reset cannot overwrite a reset it has not seen.
+   */
+  putAccountKey(key: AccountKey, expectedVersion?: number): Promise<boolean>;
+
   /* ---- Agent commands ---- */
   putCommand(command: AgentCommand): Promise<void>;
   claimCommands(deviceId: string, now?: number): Promise<AgentCommand[]>;
diff --git a/app/server/lib/types.ts b/app/server/lib/types.ts
index c1a2162..630d8c7 100644
--- a/app/server/lib/types.ts
+++ b/app/server/lib/types.ts
@@ -73,13 +73,38 @@ export interface AuditEvent {
   text: string;
 }
 
-/** A session password sealed to one member's browser key. */
+/**
+ * A session password sealed to one member.
+ *
+ * Older shares are sealed to a browser key; newer ones to the member's account
+ * key, marked by a "v2." prefix on `sealed`. The service cannot tell them
+ * apart any better than that and does not need to.
+ */
 export interface SessionKeyShare {
   uid: string;
   senderPublicKey: string;
   sealed: string;
 }
 
+/**
+ * A person's session vault.
+ *
+ * The public key is what session passwords are sealed to. The private key is
+ * held only encrypted under a vault key, and the vault key only wrapped under
+ * a recovery key this service never receives, so none of this opens anything
+ * here.
+ */
+export interface AccountKey {
+  uid: string;
+  publicKey: string;
+  encryptedPrivateKey: string;
+  recoveryWrap: string;
+  /** Starts at 1 and counts resets. */
+  version: number;
+  createdAt: number;
+  updatedAt: number;
+}
+
 export interface Comment {
   id: string;
   orgId: string;
diff --git a/app/server/lib/vault.test.ts b/app/server/lib/vault.test.ts
new file mode 100644
index 0000000..d30e352
--- /dev/null
+++ b/app/server/lib/vault.test.ts
@@ -0,0 +1,132 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { isP256PublicKey, readOwnerShare, readVaultInput } from "./vault";
+import { createVault, openFromAccount, sealToAccount } from "../../src/lib/vault-crypto";
+
+/*
+ * The service cannot open a vault, so all it can hold the line on is shape.
+ * These tests feed it exactly what the browser makes, so a change on either
+ * side that the other would reject fails here rather than at sign-up.
+ */
+
+function encode(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function decode(value: string): Uint8Array<ArrayBuffer> {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+
+async function browserVault() {
+  const made = await createVault("uid-1");
+  return {
+    public_key: made.bundle.publicKey,
+    encrypted_private_key: made.bundle.encryptedPrivateKey,
+    recovery_wrap: made.bundle.recoveryWrap,
+  };
+}
+
+describe("a vault the service is handed", () => {
+  it("accepts what the browser makes", async () => {
+    const body = await browserVault();
+    const result = await readVaultInput(body);
+    expect(result).toMatchObject({ ok: true, value: { publicKey: body.public_key } });
+  });
+
+  it("refuses a public key that is not a point on the curve", async () => {
+    const body = await browserVault();
+    const offCurve = new Uint8Array(65);
+    offCurve[0] = 0x04;
+    offCurve[64] = 0x07;
+    expect(await isP256PublicKey(encode(offCurve))).toBe(false);
+    expect(await readVaultInput({ ...body, public_key: encode(offCurve) })).toMatchObject({ ok: false });
+  });
+
+  it("refuses fields that are not the size the browser produces", async () => {
+    const body = await browserVault();
+    expect(await readVaultInput({ ...body, recovery_wrap: encode(new Uint8Array(59)) })).toMatchObject({ ok: false });
+    expect(await readVaultInput({ ...body, encrypted_private_key: "short" })).toMatchObject({ ok: false });
+    expect(await readVaultInput({ ...body, encrypted_private_key: "not base64url!" })).toMatchObject({ ok: false });
+    expect(await readVaultInput({ ...body, public_key: undefined })).toMatchObject({ ok: false });
+  });
+
+  it("refuses a replace_version that is not a version", async () => {
+    const body = await browserVault();
+    for (const replace_version of [0, -1, 1.5, "1", null]) {
+      expect(await readVaultInput({ ...body, replace_version })).toMatchObject({ ok: false });
+    }
+    expect(await readVaultInput({ ...body, replace_version: 3 })).toMatchObject({
+      ok: true,
+      value: { replaceVersion: 3 },
+    });
+  });
+});
+
+describe("the CLI's own copy of a password", () => {
+  it("is accepted when it is a vault share", async () => {
+    const made = await createVault("uid-1");
+    const share = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "Kw9eHbru");
+    expect(await readOwnerShare({ sender_public_key: share.senderPublicKey, sealed: share.sealed })).toEqual(share);
+  });
+
+  it("is dropped when it is anything else", async () => {
+    const made = await createVault("uid-1");
+    const share = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "Kw9eHbru");
+    expect(await readOwnerShare(undefined)).toBeNull();
+    expect(await readOwnerShare("share")).toBeNull();
+    /* Without the prefix it is a browser-key share, which the CLI never makes. */
+    expect(await readOwnerShare({ sender_public_key: share.senderPublicKey, sealed: share.sealed.slice(3) })).toBeNull();
+    expect(await readOwnerShare({ sender_public_key: "junk", sealed: share.sealed })).toBeNull();
+    expect(await readOwnerShare({ sender_public_key: share.senderPublicKey, sealed: "v2." })).toBeNull();
+  });
+});
+
+/*
+ * The CLI seals a session's password when it registers the session, and the
+ * browser opens it. The vector was sealed by the Go code with fixed inputs
+ * (internal/account/vault_test.go regenerates and checks it), so the two
+ * implementations cannot drift apart unnoticed. The Go tests open the
+ * browser's vector in the other direction.
+ */
+describe("a password the CLI sealed", () => {
+  it("opens in the browser", async () => {
+    const vector = JSON.parse(
+      readFileSync(
+        fileURLToPath(new URL("../../../internal/account/testdata/vault-share-v2-go.json", import.meta.url)),
+        "utf8",
+      ),
+    ) as {
+      recipient_private_key_hex: string;
+      recipient_public_key: string;
+      session_id: string;
+      uid: string;
+      password: string;
+      sender_public_key: string;
+      sealed: string;
+    };
+    const point = decode(vector.recipient_public_key);
+    const scalar = Uint8Array.from(vector.recipient_private_key_hex.match(/../g)!, (pair) => parseInt(pair, 16));
+    const privateKey = await crypto.subtle.importKey(
+      "jwk",
+      {
+        kty: "EC",
+        crv: "P-256",
+        d: encode(scalar),
+        x: encode(point.slice(1, 33)),
+        y: encode(point.slice(33, 65)),
+      },
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      ["deriveBits"],
+    );
+    const opened = await openFromAccount(privateKey, vector.session_id, vector.uid, {
+      senderPublicKey: vector.sender_public_key,
+      sealed: vector.sealed,
+    });
+    expect(opened).toBe(vector.password);
+  });
+});
diff --git a/app/server/lib/vault.ts b/app/server/lib/vault.ts
new file mode 100644
index 0000000..4b9e116
--- /dev/null
+++ b/app/server/lib/vault.ts
@@ -0,0 +1,124 @@
+import type { AccountKey, SessionKeyShare } from "./types";
+
+/**
+ * The shapes a session vault arrives in, checked before anything is stored.
+ *
+ * Nothing here can be verified cryptographically: the service holds no key
+ * that opens any of it, which is the point. What it can check is that each
+ * field is the size and encoding the browser produces, so the store cannot
+ * fill with junk that looks like somebody's vault, and that the public key is
+ * a real P-256 point, since colleagues and the CLI will seal passwords to it.
+ */
+
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+
+/* An uncompressed P-256 point is 65 bytes, which is 87 base64url characters. */
+const PUBLIC_KEY_LENGTH = 87;
+/* Nonce, a 32-byte vault key, and the GCM tag. */
+const RECOVERY_WRAP_BYTES = 12 + 32 + 16;
+/* Nonce, a PKCS#8 P-256 key (about 138 bytes), and the tag, with room to spare. */
+const PRIVATE_KEY_MIN_BYTES = 12 + 64 + 16;
+const PRIVATE_KEY_MAX_BYTES = 512;
+/* A share holds a password of at most 1,024 bytes, which is what the CLI accepts. */
+const SHARE_MAX_BYTES = 12 + 1024 + 16;
+
+/** The prefix of a password sealed to an account key rather than a browser key. */
+export const VAULT_SHARE_PREFIX = "v2.";
+
+/**
+ * How recently someone must have signed in to replace their vault.
+ *
+ * A reset puts a new key where colleagues will seal passwords, so it is the
+ * one vault operation worth more than a long-lived session token. Signing in
+ * again is the proof asked for.
+ */
+export const RESET_SIGN_IN_WINDOW_MS = 10 * 60_000;
+
+function decodedLength(value: string): number | null {
+  if (!BASE64URL.test(value) || value.length % 4 === 1) return null;
+  return Math.floor((value.length * 3) / 4);
+}
+
+function fromBase64Url(value: string): Uint8Array<ArrayBuffer> {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+
+/** True for a base64url P-256 public key that is really on the curve. */
+export async function isP256PublicKey(value: unknown): Promise<boolean> {
+  if (typeof value !== "string" || value.length !== PUBLIC_KEY_LENGTH || decodedLength(value) !== 65) {
+    return false;
+  }
+  try {
+    await crypto.subtle.importKey("raw", fromBase64Url(value), { name: "ECDH", namedCurve: "P-256" }, true, []);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export interface VaultInput {
+  publicKey: string;
+  encryptedPrivateKey: string;
+  recoveryWrap: string;
+  /** Present when the caller means to replace the vault at this version. */
+  replaceVersion?: number;
+}
+
+export type VaultInputResult = { ok: true; value: VaultInput } | { ok: false; reason: string };
+
+export async function readVaultInput(body: Record<string, unknown>): Promise<VaultInputResult> {
+  const { public_key: publicKey, encrypted_private_key: encryptedPrivateKey, recovery_wrap: recoveryWrap } = body;
+  if (!(await isP256PublicKey(publicKey))) return { ok: false, reason: "invalid public key" };
+
+  const privateLength = typeof encryptedPrivateKey === "string" ? decodedLength(encryptedPrivateKey) : null;
+  if (privateLength === null || privateLength < PRIVATE_KEY_MIN_BYTES || privateLength > PRIVATE_KEY_MAX_BYTES) {
+    return { ok: false, reason: "invalid encrypted private key" };
+  }
+  if (typeof recoveryWrap !== "string" || decodedLength(recoveryWrap) !== RECOVERY_WRAP_BYTES) {
+    return { ok: false, reason: "invalid recovery wrap" };
+  }
+
+  const replace = body.replace_version;
+  if (replace !== undefined && (typeof replace !== "number" || !Number.isInteger(replace) || replace < 1)) {
+    return { ok: false, reason: "invalid replace_version" };
+  }
+
+  return {
+    ok: true,
+    value: {
+      publicKey: publicKey as string,
+      encryptedPrivateKey: encryptedPrivateKey as string,
+      recoveryWrap,
+      replaceVersion: replace as number | undefined,
+    },
+  };
+}
+
+/** What a browser is told about its own vault: everything, since none of it is readable without the recovery key. */
+export function vaultForApi(key: AccountKey) {
+  return {
+    publicKey: key.publicKey,
+    encryptedPrivateKey: key.encryptedPrivateKey,
+    recoveryWrap: key.recoveryWrap,
+    version: key.version,
+    createdAt: key.createdAt,
+    updatedAt: key.updatedAt,
+  };
+}
+
+/**
+ * The copy of a session password the CLI seals to its own account.
+ *
+ * Returns null for anything that is not shaped like one. A session must still
+ * register when this is wrong, so the caller drops it rather than failing.
+ */
+export async function readOwnerShare(value: unknown): Promise<Omit<SessionKeyShare, "uid"> | null> {
+  if (!value || typeof value !== "object") return null;
+  const { sender_public_key: senderPublicKey, sealed } = value as Record<string, unknown>;
+  if (!(await isP256PublicKey(senderPublicKey))) return null;
+  if (typeof sealed !== "string" || !sealed.startsWith(VAULT_SHARE_PREFIX)) return null;
+  const length = decodedLength(sealed.slice(VAULT_SHARE_PREFIX.length));
+  if (length === null || length < 12 + 16 + 1 || length > SHARE_MAX_BYTES) return null;
+  return { senderPublicKey: senderPublicKey as string, sealed };
+}
diff --git a/app/src/App.tsx b/app/src/App.tsx
index 533720f..2394d7b 100644
--- a/app/src/App.tsx
+++ b/app/src/App.tsx
@@ -13,11 +13,14 @@ import { Terms } from "./routes/Terms";
 import { Session } from "./routes/Session";
 import { Audit } from "./routes/Audit";
 import { CliAuthorize } from "./routes/CliAuthorize";
+import { VaultProvider } from "./vault/VaultProvider";
+import { VaultGate } from "./vault/VaultGate";
 
 export default function App() {
   return (
     <BrowserRouter>
       <AuthProvider>
+        <VaultProvider>
         <Routes>
           <Route path="/" element={<Navigate to="/login" replace />} />
           <Route
@@ -56,7 +59,9 @@ export default function App() {
             path="/sessions/:sessionId"
             element={
               <RequireAuth>
-                <Session />
+                <VaultGate>
+                  <Session />
+                </VaultGate>
               </RequireAuth>
             }
           />
@@ -92,7 +97,9 @@ export default function App() {
             path="/sessions"
             element={
               <RequireAuth>
-                <Workspace />
+                <VaultGate>
+                  <Workspace />
+                </VaultGate>
               </RequireAuth>
             }
           />
@@ -103,6 +110,7 @@ export default function App() {
           <Route path="/cli/authorize" element={<CliAuthorize />} />
           <Route path="*" element={<Navigate to="/login" replace />} />
         </Routes>
+        </VaultProvider>
       </AuthProvider>
     </BrowserRouter>
   );
diff --git a/app/src/auth/AuthProvider.tsx b/app/src/auth/AuthProvider.tsx
index b195f1f..7f468f2 100644
--- a/app/src/auth/AuthProvider.tsx
+++ b/app/src/auth/AuthProvider.tsx
@@ -20,6 +20,7 @@ import {
 } from "firebase/auth";
 import { auth, googleProvider } from "../lib/firebase";
 import { setPasswordOwner } from "../lib/session-passwords";
+import { clearLocalVault } from "../lib/vault-store";
 
 interface AuthValue {
   user: User | null;
@@ -94,11 +95,16 @@ export function AuthProvider({ children }: { children: ReactNode }) {
 
   const signOutUser = useCallback(async () => {
     /*
-     * Stored session passwords are keyed by account, so signing out does not
-     * expose them to whoever signs in next. They are deliberately kept: they
-     * are how this person reopens their own sessions, and how they share them
-     * with colleagues who join later.
+     * Signing out locks the vault in this browser, so a shared computer does
+     * not keep an unlocked key for whoever signed out. The vault itself is
+     * untouched and the next sign-in unlocks it with the recovery key.
+     *
+     * Cached session passwords are keyed by account, so they are not exposed
+     * to whoever signs in next, and they are only a cache now: the vault holds
+     * the copies that matter.
      */
+    const current = auth.currentUser;
+    if (current) await clearLocalVault(current.uid);
     await signOut(auth);
   }, []);
 
diff --git a/app/src/components/NewSessionModal.tsx b/app/src/components/NewSessionModal.tsx
index f0e5991..95f5eda 100644
--- a/app/src/components/NewSessionModal.tsx
+++ b/app/src/components/NewSessionModal.tsx
@@ -229,8 +229,9 @@ export function NewSessionModal({
                 <Warning size={14} weight="fill" />
                 <span>
                   <b>{chosenMachine.label}</b> is running an older build that
-                  cannot receive a password. Update shell there, or the session
-                  will ask for one you cannot see.
+                  cannot receive a password, so a session started there could
+                  never be opened here. Update shell on that machine, then try
+                  again.
                 </span>
               </p>
             )}
@@ -308,7 +309,7 @@ export function NewSessionModal({
                 type="submit"
                 busy={busy}
                 busyLabel="Starting"
-                disabled={!command || !machine || !machineReady}
+                disabled={!command || !machine || !machineReady || !chosenMachine?.agentPublicKey}
               >
                 Start session
               </Button>
diff --git a/app/src/components/SessionAudience.tsx b/app/src/components/SessionAudience.tsx
index 79c9112..16a4aab 100644
--- a/app/src/components/SessionAudience.tsx
+++ b/app/src/components/SessionAudience.tsx
@@ -1,22 +1,24 @@
 import { useEffect, useState } from "react";
-import { UserPlus } from "@phosphor-icons/react";
+import { UserPlus, Warning } from "@phosphor-icons/react";
 import { Avatar } from "./Avatar";
+import { Button } from "./Button";
 import { PersonPicker } from "./PersonPicker";
 import { shareSessionKeys, type Member, type SessionRecord } from "../lib/api";
-import { openSealed, sealForMembers } from "../lib/keypair";
 import { addToAudience, audienceFor, passwordFor } from "../lib/session-passwords";
+import { keyTrust, trustKey } from "../lib/known-keys";
 import { displayName } from "../lib/people";
+import { assigneeIds } from "../lib/session-view";
+import { useVault } from "../vault/VaultProvider";
 
 /**
  * Who else can open this session.
  *
- * The password is sealed once per person, so this list is the whole of the
- * answer: a colleague who is not on it holds nothing, whatever the session
- * says about who it is assigned to. Assigning a session to somebody used to
- * appear to hand it over because the password had already gone to everyone.
+ * The password is sealed once per person, to their vault, so this list is the
+ * whole of the answer: a colleague who is not on it holds nothing, whatever
+ * the session says about who it is assigned to.
  *
- * Only ever adds. Removing somebody here would not reach into their browser
- * and take back the copy they hold, so a control that offered it would be
+ * Only ever adds. Removing somebody here would not reach into their vault and
+ * take back the copy they hold, so a control that offered it would be
  * describing something that did not happen.
  */
 export function SessionAudience({
@@ -28,55 +30,65 @@ export function SessionAudience({
   members: Member[];
   you: Member | null;
 }) {
+  const vault = useVault();
   const [audience, setAudience] = useState<string[]>(() => audienceFor(session.id));
+  const [password, setPassword] = useState<string | null>(null);
   const [busy, setBusy] = useState("");
   const [error, setError] = useState("");
-  const [held, setHeld] = useState(false);
+  /* Someone whose vault key changed, waiting for the owner to say go ahead. */
+  const [confirming, setConfirming] = useState<string | null>(null);
 
   const isOwner = Boolean(you && session.ownerUid === you.uid);
+  const sealed = session.keyShare ? `${session.keyShare.senderPublicKey}:${session.keyShare.sealed}` : "";
 
   /* Only somebody holding the password has anything to seal. */
   useEffect(() => {
     let live = true;
     void (async () => {
-      const own = passwordFor(session.id);
-      if (own) return live && setHeld(true);
-      const share = session.keyShare;
-      const opened = share ? await openSealed(share.senderPublicKey, share.sealed) : null;
-      if (live) setHeld(Boolean(opened));
+      const opened = passwordFor(session.id) ?? (await vault.openShare(session.id, session.keyShare));
+      if (live) setPassword(opened);
     })();
     return () => {
       live = false;
     };
-  }, [session]);
+    /* eslint-disable-next-line react-hooks/exhaustive-deps -- content, not identity */
+  }, [session.id, sealed, vault.openShare]);
 
-  if (!isOwner || !held) return null;
+  if (!isOwner || !password || !you) return null;
 
-  const shared = members.filter((member) => audience.includes(member.uid));
+  /* Who holds a copy: what the service stores, and what this browser has sent. */
+  const holders = new Set([...(session.sharedWith ?? []), ...audience]);
+  const shared = members.filter((member) => member.uid !== you.uid && holders.has(member.uid));
   const candidates = members.filter(
-    (member) =>
-      member.uid !== you?.uid && !audience.includes(member.uid) && Boolean(member.publicKey),
+    (member) => member.uid !== you.uid && !holders.has(member.uid) && Boolean(member.accountKey),
   );
 
-  async function add(uid: string) {
+  async function add(uid: string, confirmedChange = false) {
     const member = members.find((candidate) => candidate.uid === uid);
-    if (!member?.publicKey) return;
-    const password = passwordFor(session.id);
-    if (!password) return setError("This browser no longer holds the password for this session.");
+    if (!member?.accountKey || !password || !you) return;
+
+    /*
+     * A key this browser has sealed to before, and that has since changed, is
+     * either a colleague who reset their vault or a key that is not theirs.
+     * Nothing is sealed to it until the owner has seen that and said so.
+     */
+    if (keyTrust(you.uid, member.uid, member.accountKey) === "changed" && !confirmedChange) {
+      setConfirming(uid);
+      return;
+    }
 
     setBusy(uid);
     setError("");
+    setConfirming(null);
     try {
-      const sealed = await sealForMembers([member], password);
-      await shareSessionKeys(
-        session.id,
-        sealed.map((entry) => ({
-          uid: entry.uid,
-          sender_public_key: entry.senderPublicKey,
-          sealed: entry.sealed,
-        })),
-      );
-      setAudience(addToAudience(session.id, [uid]));
+      const share = await vault.sealTo(member, session.id, password);
+      if (!share) throw new Error(`${displayName(member)} has not set up a vault yet.`);
+      await shareSessionKeys(session.id, [
+        { uid: member.uid, sender_public_key: share.senderPublicKey, sealed: share.sealed },
+      ]);
+      trustKey(you.uid, member.uid, member.accountKey);
+      const kept = addToAudience(session.id, [uid]);
+      setAudience((current) => [...new Set([...current, ...kept, uid])]);
     } catch (caught) {
       setError(caught instanceof Error ? caught.message : "Could not share the session.");
     } finally {
@@ -84,6 +96,18 @@ export function SessionAudience({
     }
   }
 
+  const waiting = confirming ? members.find((member) => member.uid === confirming) : undefined;
+  /*
+   * Assigned, but holding no copy: someone assigned by an admin, or from
+   * another browser. The assignee list is the service's word, and owners and
+   * admins can assign anyone, themselves included, so it never seals a
+   * password on its own. The owner lets them open it here, in one click.
+   */
+  const assigned = new Set(assigneeIds(session));
+  const assignedWithout = members.filter(
+    (member) => member.uid !== you.uid && assigned.has(member.uid) && !holders.has(member.uid),
+  );
+
   return (
     <section className="audience">
       <h2 className="detail-heading">Who can open it</h2>
@@ -92,15 +116,77 @@ export function SessionAudience({
         <p className="detail-empty">Only you. Add someone and they can open it straight away.</p>
       ) : (
         <ul className="audience-list">
+          {/*
+            Everyone listed can be shared with again. The service knows who
+            holds a copy but not whether it still opens: one sealed to a
+            browser key from before the vault, or to a vault its owner has
+            since reset, does not. Sealing again is harmless, so the way back
+            is offered to everyone rather than guessed at.
+          */}
           {shared.map((member) => (
             <li key={member.uid}>
               <Avatar person={member} size="xs" />
               {displayName(member)}
+              {member.accountKey && (
+                <button
+                  type="button"
+                  className="vault-link"
+                  onClick={() => void add(member.uid)}
+                  disabled={busy === member.uid}
+                  title="Seal the password to their vault again, if they cannot open it"
+                >
+                  {busy === member.uid ? "Sharing" : "Share again"}
+                </button>
+              )}
             </li>
           ))}
         </ul>
       )}
 
+      {assignedWithout.length > 0 && (
+        <ul className="audience-assigned">
+          {assignedWithout.map((member) => (
+            <li key={member.uid}>
+              <span>
+                {displayName(member)} is assigned but cannot open it yet
+                {member.accountKey ? "." : ", and has not set up a vault."}
+              </span>
+              {member.accountKey && (
+                <button
+                  type="button"
+                  className="vault-link"
+                  onClick={() => void add(member.uid)}
+                  disabled={busy === member.uid}
+                >
+                  {busy === member.uid ? "Sharing" : "Let them open it"}
+                </button>
+              )}
+            </li>
+          ))}
+        </ul>
+      )}
+
+      {waiting && (
+        <div className="audience-confirm" role="alert">
+          <p>
+            <Warning size={14} weight="fill" />
+            <span>
+              {displayName(waiting)}&apos;s vault key has changed since you last
+              shared with them. That happens when someone resets their vault. If
+              you did not expect it, check with them before sharing.
+            </span>
+          </p>
+          <div className="audience-confirm-actions">
+            <Button type="button" variant="ghost" onClick={() => void add(waiting.uid, true)}>
+              Share anyway
+            </Button>
+            <Button type="button" variant="ghost" onClick={() => setConfirming(null)}>
+              Cancel
+            </Button>
+          </div>
+        </div>
+      )}
+
       {candidates.length > 0 && (
         <div className="audience-add">
           <UserPlus size={15} weight="bold" />
diff --git a/app/src/components/SessionClipboard.tsx b/app/src/components/SessionClipboard.tsx
index f38f13f..92abae9 100644
--- a/app/src/components/SessionClipboard.tsx
+++ b/app/src/components/SessionClipboard.tsx
@@ -2,8 +2,8 @@ import { useEffect, useRef, useState } from "react";
 import { CaretDown, Copy, Check, Link as LinkIcon, Lock, Terminal, Warning } from "@phosphor-icons/react";
 import type { Member, SessionRecord } from "../lib/api";
 import { passwordFor } from "../lib/session-passwords";
-import { openSealed } from "../lib/keypair";
 import { COPY_FAILED, useCopy } from "../lib/clipboard";
+import { useVault } from "../vault/VaultProvider";
 
 /**
  * The one place a session can be copied from.
@@ -20,17 +20,16 @@ type Item = "link" | "password" | "attach";
  * Where the password comes from, and why the service is not in the list.
  *
  * A session password never reaches the service in the clear. This browser
- * either chose it, or holds a copy a colleague sealed to this browser's public
- * key. So the answer to "may this person copy it" is not a permission the
- * service grants: they either hold a copy or they do not, and someone outside
- * the team holds nothing whatever the interface says.
+ * either holds it already, or opens the copy sealed to this person's vault.
+ * So the answer to "may this person copy it" is not a permission the service
+ * grants: they either hold a copy or they do not, and someone outside the
+ * team holds nothing whatever the interface says.
  */
-async function readPassword(session: SessionRecord): Promise<string | null> {
-  const own = passwordFor(session.id);
-  if (own) return own;
-  const share = session.keyShare;
-  if (!share) return null;
-  return openSealed(share.senderPublicKey, share.sealed);
+async function readPassword(
+  session: SessionRecord,
+  openShare: (sessionId: string, share: SessionRecord["keyShare"]) => Promise<string | null>,
+): Promise<string | null> {
+  return passwordFor(session.id) ?? openShare(session.id, session.keyShare);
 }
 
 export function SessionClipboard({
@@ -67,16 +66,17 @@ export function SessionClipboard({
   const sealed = session.keyShare
     ? `${session.keyShare.senderPublicKey}:${session.keyShare.sealed}`
     : "";
+  const { openShare } = useVault();
   useEffect(() => {
     let live = true;
-    void readPassword(session).then((value) => {
+    void readPassword(session, openShare).then((value) => {
       if (live) setPassword(value);
     });
     return () => {
       live = false;
     };
     /* eslint-disable-next-line react-hooks/exhaustive-deps -- see above */
-  }, [session.id, sealed]);
+  }, [session.id, sealed, openShare]);
 
   useEffect(() => {
     if (!open) return;
diff --git a/app/src/lib/api.ts b/app/src/lib/api.ts
index 95dad3f..92141da 100644
--- a/app/src/lib/api.ts
+++ b/app/src/lib/api.ts
@@ -26,8 +26,10 @@ export interface Member {
   name: string;
   role: Role;
   joinedAt: number;
-  /** Their browser key, so a session password can be sealed to them. */
+  /** A browser key from before the vault. Kept only so old shares still name it. */
   publicKey?: string;
+  /** Their vault's public key; absent until they have set one up. */
+  accountKey?: string;
 }
 
 export interface Team {
@@ -108,6 +110,36 @@ export function shareSessionKeys(
   );
 }
 
+/** Your vault as the service holds it: a public key and two pieces of ciphertext. */
+export interface VaultRecord {
+  publicKey: string;
+  encryptedPrivateKey: string;
+  recoveryWrap: string;
+  version: number;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export function fetchVault() {
+  return request<{ vault: VaultRecord | null }>("/api/vault");
+}
+
+/** Saves a new vault, or replaces the one at `replaceVersion` when resetting. */
+export function saveVault(
+  bundle: { publicKey: string; encryptedPrivateKey: string; recoveryWrap: string },
+  replaceVersion?: number,
+) {
+  return request<{ vault: VaultRecord | null }>("/api/vault", {
+    method: "POST",
+    body: JSON.stringify({
+      public_key: bundle.publicKey,
+      encrypted_private_key: bundle.encryptedPrivateKey,
+      recovery_wrap: bundle.recoveryWrap,
+      replace_version: replaceVersion,
+    }),
+  });
+}
+
 export function assignSession(sessionId: string, uids: string[]) {
   return request<{ session: SessionRecord }>(
     `/api/sessions/${encodeURIComponent(sessionId)}/assignee`,
@@ -186,6 +218,12 @@ export interface SessionRecord {
   deviceId?: string;
   /** The password sealed to the caller, when one has been shared with them. */
   keyShare?: { senderPublicKey: string; sealed: string };
+  /**
+   * For the session's owner: who else holds a sealed copy. The service knows
+   * this because it stores the copies; it is shown, never used to decide who
+   * to seal to.
+   */
+  sharedWith?: string[];
   readOnly: boolean;
   encrypted: boolean;
   persistent: boolean;
diff --git a/app/src/lib/keypair.ts b/app/src/lib/keypair.ts
index 4cd4b9c..1157b25 100644
--- a/app/src/lib/keypair.ts
+++ b/app/src/lib/keypair.ts
@@ -1,5 +1,13 @@
 /**
- * This browser's key pair, used to receive session passwords from colleagues.
+ * This browser's key pair, from before the session vault.
+ *
+ * Kept only to open passwords a colleague sealed to this browser before the
+ * vault existed. Nothing new is sealed to it and it is no longer published:
+ * shares now go to the account's vault key (see vault-crypto.ts), which every
+ * browser the person unlocks can open. Each old share is resealed to the vault
+ * the first time it opens a session here.
+ *
+ * What follows describes how it worked.
  *
  * A session's password is chosen by whoever starts it. For anyone else in the
  * team to open that session, the password has to reach them without
diff --git a/app/src/lib/known-keys.ts b/app/src/lib/known-keys.ts
new file mode 100644
index 0000000..cd4f446
Binary files /dev/null and b/app/src/lib/known-keys.ts differ
diff --git a/app/src/lib/seal.ts b/app/src/lib/seal.ts
index 9088af9..aa6908c 100644
--- a/app/src/lib/seal.ts
+++ b/app/src/lib/seal.ts
@@ -27,11 +27,15 @@ function fromBase64Url(value: string): Uint8Array {
 }
 
 /**
- * A browser password in the shape the CLI generates: eight base64url
- * characters from six random bytes.
+ * A browser password for a session started here: base64url from sixteen
+ * random bytes.
+ *
+ * The CLI's own default is eight characters, a trade for someone who has to
+ * type it. Nobody types this one. It travels to the machine sealed and to the
+ * vault sealed, so there is no reason for it to be weaker than a key.
  */
 export function generatePassword(): string {
-  return toBase64Url(crypto.getRandomValues(new Uint8Array(6)));
+  return toBase64Url(crypto.getRandomValues(new Uint8Array(16)));
 }
 
 export interface Sealed {
diff --git a/app/src/lib/session-passwords.test.ts b/app/src/lib/session-passwords.test.ts
index 621b350..a531527 100644
Binary files a/app/src/lib/session-passwords.test.ts and b/app/src/lib/session-passwords.test.ts differ
diff --git a/app/src/lib/session-passwords.ts b/app/src/lib/session-passwords.ts
index 20ecf3a..d8c0989 100644
Binary files a/app/src/lib/session-passwords.ts and b/app/src/lib/session-passwords.ts differ
diff --git a/app/src/lib/session-share.test.ts b/app/src/lib/session-share.test.ts
index 22ec332..38991f5 100644
--- a/app/src/lib/session-share.test.ts
+++ b/app/src/lib/session-share.test.ts
@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import { sealTargets, shareCandidates } from "./session-share";
 import type { Member } from "./api";
 
-function member(uid: string, publicKey?: string): Member {
+function member(uid: string, accountKey?: string): Member {
   return {
     orgId: "org",
     uid,
@@ -10,7 +10,7 @@ function member(uid: string, publicKey?: string): Member {
     name: uid,
     role: "member",
     joinedAt: 0,
-    publicKey,
+    accountKey,
   };
 }
 
@@ -22,7 +22,7 @@ describe("who can be offered a session password", () => {
     expect(reachable.map((entry) => entry.uid)).toEqual(["a"]);
   });
 
-  it("separates people with no browser key from people with one", () => {
+  it("separates people with no vault from people with one", () => {
     const { reachable, unreachable } = shareCandidates(
       [you, member("a", "key-a"), member("b")],
       you,
@@ -31,6 +31,14 @@ describe("who can be offered a session password", () => {
     expect(unreachable.map((entry) => entry.uid)).toEqual(["b"]);
   });
 
+  /* A browser key from before the vault is not somewhere to seal a new password. */
+  it("does not count an old browser key as a vault", () => {
+    const legacy: Member = { ...member("c"), publicKey: "browser-key" };
+    const { reachable, unreachable } = shareCandidates([you, legacy], you);
+    expect(reachable).toEqual([]);
+    expect(unreachable.map((entry) => entry.uid)).toEqual(["c"]);
+  });
+
   it("offers the whole team to somebody who is not in it", () => {
     const { reachable } = shareCandidates([member("a", "key-a")], null);
     expect(reachable.map((entry) => entry.uid)).toEqual(["a"]);
@@ -55,7 +63,7 @@ describe("who a session password is sealed to", () => {
     expect(targets.map((entry) => entry.uid)).toEqual(["a"]);
   });
 
-  it("skips somebody chosen who has no key to seal to", () => {
+  it("skips somebody chosen who has no vault to seal to", () => {
     const targets = sealTargets({ members: team, you, chosen: ["c"] });
     expect(targets).toEqual([]);
   });
diff --git a/app/src/lib/session-share.ts b/app/src/lib/session-share.ts
index 92f876d..0e9c1c1 100644
--- a/app/src/lib/session-share.ts
+++ b/app/src/lib/session-share.ts
@@ -13,9 +13,9 @@ import type { Member } from "./api";
 /**
  * Splits the team into people a password can reach and people it cannot.
  *
- * A member who has never opened the app in a browser has published no public
- * key, so there is nowhere to send them anything. Offering them a tick box
- * would be offering something that silently does nothing.
+ * A member who has not set up their vault has no key to seal to, so there is
+ * nowhere to send them anything. Offering them a tick box would be offering
+ * something that silently does nothing.
  */
 export function shareCandidates(
   members: Member[],
@@ -23,8 +23,8 @@ export function shareCandidates(
 ): { reachable: Member[]; unreachable: Member[] } {
   const others = members.filter((member) => member.uid !== you?.uid);
   return {
-    reachable: others.filter((member) => Boolean(member.publicKey)),
-    unreachable: others.filter((member) => !member.publicKey),
+    reachable: others.filter((member) => Boolean(member.accountKey)),
+    unreachable: others.filter((member) => !member.accountKey),
   };
 }
 
diff --git a/app/src/lib/vault-crypto.test.ts b/app/src/lib/vault-crypto.test.ts
new file mode 100644
index 0000000..de41bcc
--- /dev/null
+++ b/app/src/lib/vault-crypto.test.ts
@@ -0,0 +1,206 @@
+import { describe, expect, it } from "vitest";
+import {
+  createVault,
+  fingerprint,
+  formatRecoveryKey,
+  isVaultShare,
+  openFromAccount,
+  openVault,
+  parseRecoveryKey,
+  sealToAccount,
+  VaultError,
+} from "./vault-crypto";
+
+/*
+ * These tests are the vault's claim: that a password sealed to an account can
+ * be opened by that account in any browser holding its recovery key, and by
+ * nothing the service holds. Each names the property it keeps.
+ *
+ * That the CLI and this code agree on the share format is held by
+ * server/lib/vault.test.ts, which can read the Go test vector from disk.
+ */
+
+function decode(value: string): Uint8Array<ArrayBuffer> {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+
+function encode(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+/* Flips a bit in the bytes, not the text; see keypair.test.ts for why. */
+function tamper(envelope: string, index: number): string {
+  const bytes = decode(envelope);
+  bytes[index] ^= 0x01;
+  return encode(bytes);
+}
+
+describe("recovery keys", () => {
+  it("are eight groups of four from an alphabet with nothing that reads as something else", () => {
+    const text = formatRecoveryKey(crypto.getRandomValues(new Uint8Array(20)));
+    expect(text).toMatch(/^([0-9A-HJKMNP-TV-Z]{4}-){7}[0-9A-HJKMNP-TV-Z]{4}$/);
+  });
+
+  it("read back to the same bytes", () => {
+    const bytes = crypto.getRandomValues(new Uint8Array(20));
+    expect(parseRecoveryKey(formatRecoveryKey(bytes))).toEqual(bytes);
+  });
+
+  it("forgive the ways a person types one back", () => {
+    const bytes = new Uint8Array(20).fill(0);
+    bytes[19] = 1;
+    const text = formatRecoveryKey(bytes);
+    expect(text).toBe("0000-0000-0000-0000-0000-0000-0000-0001");
+    const typed = "oooo oooo OOOO-0000 0000 0000 0000 000l";
+    expect(parseRecoveryKey(typed)).toEqual(bytes);
+    expect(parseRecoveryKey(text.toLowerCase().replace(/-/g, ""))).toEqual(bytes);
+  });
+
+  it("refuse anything that is not one", () => {
+    expect(parseRecoveryKey("")).toBeNull();
+    expect(parseRecoveryKey("0000-0000")).toBeNull();
+    expect(parseRecoveryKey("UUUU-0000-0000-0000-0000-0000-0000-0000")).toBeNull();
+  });
+});
+
+describe("a vault", () => {
+  it("opens with its recovery key and yields the same key pair", async () => {
+    const made = await createVault("uid-1");
+    const opened = await openVault("uid-1", made.bundle, parseRecoveryKey(made.recoveryKey)!);
+    expect(opened.publicKey).toBe(made.bundle.publicKey);
+
+    /* What one sealed, the other opens: they are one key pair. */
+    const share = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "Kw9eHbru");
+    expect(await openFromAccount(opened.privateKey, "sess_1", "uid-1", share)).toBe("Kw9eHbru");
+    expect(await openFromAccount(made.opened.privateKey, "sess_1", "uid-1", share)).toBe("Kw9eHbru");
+  });
+
+  it("keeps its private key unreadable by script once opened", async () => {
+    const made = await createVault("uid-1");
+    const opened = await openVault("uid-1", made.bundle, parseRecoveryKey(made.recoveryKey)!);
+    expect(opened.privateKey.extractable).toBe(false);
+    expect(made.opened.privateKey.extractable).toBe(false);
+    await expect(crypto.subtle.exportKey("pkcs8", opened.privateKey)).rejects.toThrow();
+  });
+
+  it("gives the service nothing that contains the recovery key", async () => {
+    const made = await createVault("uid-1");
+    const stored = JSON.stringify(made.bundle);
+    expect(stored).not.toContain(made.recoveryKey);
+    expect(stored).not.toContain(made.recoveryKey.replace(/-/g, ""));
+  });
+
+  it("refuses the wrong recovery key", async () => {
+    const made = await createVault("uid-1");
+    const other = await createVault("uid-1");
+    await expect(openVault("uid-1", made.bundle, parseRecoveryKey(other.recoveryKey)!)).rejects.toMatchObject({
+      kind: "wrong-recovery-key",
+    });
+  });
+
+  it("belongs to one account: its recovery key opens nothing under another uid", async () => {
+    const made = await createVault("uid-1");
+    await expect(
+      openVault("uid-2", made.bundle, parseRecoveryKey(made.recoveryKey)!),
+    ).rejects.toBeInstanceOf(VaultError);
+  });
+
+  /*
+   * The public key is the one field the service could swap without holding a
+   * secret. Sealing to a swapped key would hand it every password, so opening
+   * checks the pair and refuses.
+   */
+  it("refuses a public key the service swapped in", async () => {
+    const made = await createVault("uid-1");
+    const impostor = await createVault("uid-1");
+    await expect(
+      openVault("uid-1", { ...made.bundle, publicKey: impostor.bundle.publicKey }, parseRecoveryKey(made.recoveryKey)!),
+    ).rejects.toMatchObject({ kind: "damaged" });
+  });
+
+  it("refuses an encrypted private key that has been altered", async () => {
+    const made = await createVault("uid-1");
+    await expect(
+      openVault(
+        "uid-1",
+        { ...made.bundle, encryptedPrivateKey: tamper(made.bundle.encryptedPrivateKey, 20) },
+        parseRecoveryKey(made.recoveryKey)!,
+      ),
+    ).rejects.toMatchObject({ kind: "damaged" });
+  });
+
+  it("refuses a wrapped vault key moved into the private key's place", async () => {
+    const made = await createVault("uid-1");
+    await expect(
+      openVault(
+        "uid-1",
+        { ...made.bundle, recoveryWrap: made.bundle.encryptedPrivateKey },
+        parseRecoveryKey(made.recoveryKey)!,
+      ),
+    ).rejects.toBeInstanceOf(VaultError);
+  });
+});
+
+describe("a password sealed to an account", () => {
+  it("is marked as a vault share and does not contain the password", async () => {
+    const made = await createVault("uid-1");
+    const share = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "correct horse");
+    expect(isVaultShare(share.sealed)).toBe(true);
+    expect(share.sealed).not.toContain("correct");
+    expect(atob(share.sealed.slice(3).replace(/-/g, "+").replace(/_/g, "/"))).not.toContain("horse");
+  });
+
+  it("opens only for the session it was sealed for", async () => {
+    const made = await createVault("uid-1");
+    const share = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "pw");
+    expect(await openFromAccount(made.opened.privateKey, "sess_2", "uid-1", share)).toBeNull();
+  });
+
+  it("opens only for the person it was sealed for", async () => {
+    const made = await createVault("uid-1");
+    const share = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "pw");
+    expect(await openFromAccount(made.opened.privateKey, "sess_1", "uid-2", share)).toBeNull();
+  });
+
+  it("does not open with another account's key", async () => {
+    const mine = await createVault("uid-1");
+    const theirs = await createVault("uid-1");
+    const share = await sealToAccount(mine.bundle.publicKey, "sess_1", "uid-1", "pw");
+    expect(await openFromAccount(theirs.opened.privateKey, "sess_1", "uid-1", share)).toBeNull();
+  });
+
+  it("refuses ciphertext that has been altered", async () => {
+    const made = await createVault("uid-1");
+    const share = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "pw");
+    const altered = { ...share, sealed: `v2.${tamper(share.sealed.slice(3), 14)}` };
+    expect(await openFromAccount(made.opened.privateKey, "sess_1", "uid-1", altered)).toBeNull();
+  });
+
+  it("leaves a share from before the vault to the old browser key", async () => {
+    const made = await createVault("uid-1");
+    const share = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "pw");
+    const legacy = { ...share, sealed: share.sealed.slice(3) };
+    expect(isVaultShare(legacy.sealed)).toBe(false);
+    expect(await openFromAccount(made.opened.privateKey, "sess_1", "uid-1", legacy)).toBeNull();
+  });
+
+  it("never seals the same password to the same bytes twice", async () => {
+    const made = await createVault("uid-1");
+    const first = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "same");
+    const second = await sealToAccount(made.bundle.publicKey, "sess_1", "uid-1", "same");
+    expect(first.sealed).not.toBe(second.sealed);
+    expect(first.senderPublicKey).not.toBe(second.senderPublicKey);
+  });
+});
+
+describe("fingerprints", () => {
+  it("are four groups of four hex digits, stable for one key", async () => {
+    const made = await createVault("uid-1");
+    const print = await fingerprint(made.bundle.publicKey);
+    expect(print).toMatch(/^[0-9a-f]{4}(-[0-9a-f]{4}){3}$/);
+    expect(await fingerprint(made.bundle.publicKey)).toBe(print);
+  });
+});
diff --git a/app/src/lib/vault-crypto.ts b/app/src/lib/vault-crypto.ts
new file mode 100644
index 0000000..c833309
Binary files /dev/null and b/app/src/lib/vault-crypto.ts differ
diff --git a/app/src/lib/vault-store.ts b/app/src/lib/vault-store.ts
new file mode 100644
index 0000000..2328131
--- /dev/null
+++ b/app/src/lib/vault-store.ts
@@ -0,0 +1,93 @@
+/**
+ * Where this browser keeps its unlocked vault.
+ *
+ * IndexedDB rather than localStorage, because it can hold a CryptoKey as the
+ * browser's own object. The key was imported non-extractable, so script on
+ * this page can use it to open a password but cannot read it out, not even
+ * script that should not be here. The browser key pair this replaces sat in
+ * localStorage as a readable JWK.
+ *
+ * Losing this costs a recovery key, not a session: the vault itself is kept
+ * by the service, sealed, and this is only the unlocked copy.
+ */
+
+const DATABASE = "shell.online:vault";
+const STORE = "vaults";
+
+export interface LocalVault {
+  uid: string;
+  publicKey: string;
+  /** The vault version this key belongs to, so a reset elsewhere is noticed. */
+  version: number;
+  privateKey: CryptoKey;
+}
+
+function openDatabase(): Promise<IDBDatabase> {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DATABASE, 1);
+    request.onupgradeneeded = () => {
+      request.result.createObjectStore(STORE, { keyPath: "uid" });
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+  });
+}
+
+async function run<T>(
+  mode: IDBTransactionMode,
+  action: (store: IDBObjectStore) => IDBRequest<T>,
+): Promise<T> {
+  const database = await openDatabase();
+  try {
+    return await new Promise<T>((resolve, reject) => {
+      const transaction = database.transaction(STORE, mode);
+      const request = action(transaction.objectStore(STORE));
+      transaction.oncomplete = () => resolve(request.result);
+      transaction.onerror = () => reject(transaction.error);
+      transaction.onabort = () => reject(transaction.error);
+    });
+  } finally {
+    database.close();
+  }
+}
+
+function isLocalVault(value: unknown): value is LocalVault {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value as Partial<LocalVault>;
+  return (
+    typeof candidate.uid === "string" &&
+    typeof candidate.publicKey === "string" &&
+    typeof candidate.version === "number" &&
+    candidate.privateKey instanceof CryptoKey
+  );
+}
+
+/** The unlocked vault for this account, or null when this browser has none. */
+export async function loadLocalVault(uid: string): Promise<LocalVault | null> {
+  try {
+    const found = await run("readonly", (store) => store.get(uid));
+    return isLocalVault(found) && found.uid === uid ? found : null;
+  } catch {
+    /* Private windows and blocked storage: the vault asks again next visit. */
+    return null;
+  }
+}
+
+/** Keeps the unlocked vault. False when this browser cannot keep it. */
+export async function saveLocalVault(vault: LocalVault): Promise<boolean> {
+  try {
+    await run("readwrite", (store) => store.put(vault));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Locks the vault in this browser. The vault itself is untouched. */
+export async function clearLocalVault(uid: string): Promise<void> {
+  try {
+    await run("readwrite", (store) => store.delete(uid));
+  } catch {
+    /* nothing kept, nothing to clear */
+  }
+}
diff --git a/app/src/main.tsx b/app/src/main.tsx
index 06322e0..782da3e 100644
--- a/app/src/main.tsx
+++ b/app/src/main.tsx
@@ -10,6 +10,7 @@ import "./styles/people.css";
 import "./styles/collab.css";
 import "./styles/audit.css";
 import "./styles/terms.css";
+import "./styles/vault.css";
 
 createRoot(document.getElementById("root")!).render(
   <StrictMode>
diff --git a/app/src/routes/Account.tsx b/app/src/routes/Account.tsx
index 4c21d43..15f0a5d 100644
--- a/app/src/routes/Account.tsx
+++ b/app/src/routes/Account.tsx
@@ -6,13 +6,24 @@ import { Alert } from "../components/Alert";
 import { useAuth } from "../auth/AuthProvider";
 import { usePageTitle } from "../lib/page-title";
 import { authErrorMessage } from "../lib/auth-errors";
+import { useVault } from "../vault/VaultProvider";
+import { VaultSetup } from "../vault/VaultGate";
+
+const VAULT_STATE: Record<string, string> = {
+  loading: "Checking",
+  setup: "Not set up yet. It is set up the first time you open Sessions.",
+  locked: "Locked in this browser. Open Sessions to unlock it with your recovery key.",
+  error: "Could not be reached",
+};
 
 export function Account() {
   usePageTitle("Account");
   const { user, resendVerification, signOutUser } = useAuth();
+  const vault = useVault();
   const [notice, setNotice] = useState("");
   const [error, setError] = useState("");
   const [busy, setBusy] = useState(false);
+  const [resetting, setResetting] = useState(false);
 
   if (!user) return null;
 
@@ -66,8 +77,44 @@ export function Account() {
           <dt>User id</dt>
           <dd>{user.uid}</dd>
         </div>
+        {/*
+          The fingerprint is what `shell login` prints when a machine first
+          trusts the vault, so the two can be compared by eye.
+        */}
+        <div className="account-row">
+          <dt>Session vault</dt>
+          <dd>
+            {vault.status === "unlocked" ? (
+              <>
+                Unlocked, key <span className="vault-fingerprint">{vault.fingerprint}</span>
+                {!vault.remembered && (
+                  <span className="account-unverified">
+                    <Warning size={13} weight="fill" /> this browser cannot keep it unlocked
+                  </span>
+                )}
+              </>
+            ) : (
+              VAULT_STATE[vault.status]
+            )}
+          </dd>
+        </div>
       </dl>
 
+      {resetting && (
+        <section className="consent-card vault-card vault-reset">
+          <VaultSetup
+            reset
+            onDone={() => {
+              setResetting(false);
+              setNotice("Your new vault is on. Link your machines again with shell login.");
+            }}
+          />
+          <Button type="button" variant="ghost" onClick={() => setResetting(false)}>
+            Keep my current vault
+          </Button>
+        </section>
+      )}
+
       {/*
         Sign out lives here as well as in the sidebar. On a phone the sidebar
         becomes a bar of destinations with no room for the account row, and
@@ -86,6 +133,11 @@ export function Account() {
             Resend verification
           </Button>
         )}
+        {(vault.status === "unlocked" || vault.status === "locked") && !resetting && (
+          <Button type="button" variant="ghost" onClick={() => setResetting(true)}>
+            Reset vault
+          </Button>
+        )}
         <Button type="button" variant="ghost" onClick={() => void signOutUser()}>
           <SignOut size={15} />
           Sign out
diff --git a/app/src/routes/CliAuthorize.tsx b/app/src/routes/CliAuthorize.tsx
index 86e3120..c11e9f3 100644
--- a/app/src/routes/CliAuthorize.tsx
+++ b/app/src/routes/CliAuthorize.tsx
@@ -8,7 +8,9 @@ import { useAuth } from "../auth/AuthProvider";
 import { Booting } from "../components/Booting";
 import { approveCliLogin } from "../lib/api";
 import { usePageTitle } from "../lib/page-title";
-import { buildCallback, parseAuthorizeRequest } from "../lib/cli-authorize";
+import { buildCallback, parseAuthorizeRequest, type AuthorizeRequest } from "../lib/cli-authorize";
+import { VaultGate } from "../vault/VaultGate";
+import { useVault } from "../vault/VaultProvider";
 
 export function CliAuthorize() {
   usePageTitle("Link a machine");
@@ -16,10 +18,6 @@ export function CliAuthorize() {
   const location = useLocation();
   const parsed = useMemo(() => parseAuthorizeRequest(location.search), [location.search]);
 
-  const [busy, setBusy] = useState<"none" | "approve" | "deny">("none");
-  const [error, setError] = useState("");
-  const [handedOff, setHandedOff] = useState(false);
-
   if (initializing) return <Booting label="Checking your session" />;
 
   /*
@@ -40,6 +38,30 @@ export function CliAuthorize() {
     );
   }
 
+  /*
+   * Behind the vault, like the sessions page. The machine being linked will
+   * seal every session's password to the vault key, and it takes that key
+   * from this page, so the page must hold one it has verified itself.
+   */
+  return (
+    <VaultGate>
+      <Consent email={user.email ?? ""} parsed={parsed} />
+    </VaultGate>
+  );
+}
+
+function Consent({
+  email,
+  parsed,
+}: {
+  email: string;
+  parsed: { ok: true; request: AuthorizeRequest } | { ok: false; reason: string };
+}) {
+  const vault = useVault();
+  const [busy, setBusy] = useState<"none" | "approve" | "deny">("none");
+  const [error, setError] = useState("");
+  const [handedOff, setHandedOff] = useState(false);
+
   async function handleApprove() {
     if (!parsed.ok) return;
     setError("");
@@ -50,9 +72,16 @@ export function CliAuthorize() {
         codeChallenge: parsed.request.codeChallenge,
       });
       setHandedOff(true);
-      window.location.replace(
-        buildCallback(parsed.request.redirectUri, { code, state: parsed.request.state }),
-      );
+      /*
+       * The vault key goes to the CLI with the code, straight to its loopback
+       * listener. It is the key this browser checked against the vault's
+       * private half when it unlocked, so a service that wanted a machine to
+       * seal to some other key would have to get it past this page, not just
+       * put it in an API response.
+       */
+      const params: Record<string, string> = { code, state: parsed.request.state };
+      if (vault.publicKey) params.account_key = vault.publicKey;
+      window.location.replace(buildCallback(parsed.request.redirectUri, params));
     } catch (caught) {
       setError(caught instanceof Error ? caught.message : "Could not complete the request.");
       setBusy("none");
@@ -76,7 +105,7 @@ export function CliAuthorize() {
     <main className="consent">
       <header className="consent-head">
         <Wordmark />
-        <span className="consent-account">{user.email}</span>
+        <span className="consent-account">{email}</span>
       </header>
 
       <section className="consent-card rise rise-1">
@@ -97,7 +126,7 @@ export function CliAuthorize() {
             <h1>Link this terminal?</h1>
             <p>
               A terminal on this computer is asking to sign in as{" "}
-              <b>{user.email}</b>. Once linked, sessions you start with{" "}
+              <b>{email}</b>. Once linked, sessions you start with{" "}
               <code>shell</code> show up in your account.
             </p>
 
@@ -116,12 +145,18 @@ export function CliAuthorize() {
               </div>
               <div className="consent-row">
                 <dt>Grants</dt>
-                <dd>Publishing your sessions to this account</dd>
+                <dd>Publishing your sessions to this account, with their passwords sealed to your vault</dd>
               </div>
               <div className="consent-row">
                 <dt>Does not grant</dt>
-                <dd>Reading terminal output, or your password</dd>
+                <dd>Reading terminal output, or opening your vault</dd>
               </div>
+              {vault.fingerprint && (
+                <div className="consent-row">
+                  <dt>Vault key</dt>
+                  <dd className="vault-fingerprint">{vault.fingerprint}</dd>
+                </div>
+              )}
             </dl>
 
             <div className="consent-actions">
@@ -148,7 +183,8 @@ export function CliAuthorize() {
               <ShieldCheck size={14} weight="bold" />
               <span>
                 Terminal content stays end-to-end encrypted. Only the link, the
-                command name and the timing are published.
+                command name and the timing are published; passwords reach this
+                account sealed, and shell.online cannot open them.
               </span>
             </p>
           </>
diff --git a/app/src/routes/Session.tsx b/app/src/routes/Session.tsx
index 6d442a1..9970c63 100644
--- a/app/src/routes/Session.tsx
+++ b/app/src/routes/Session.tsx
@@ -30,6 +30,8 @@ import { displayName, findPerson } from "../lib/people";
 import { usePageTitle } from "../lib/page-title";
 import { assigneeIds, canRemove, canStop } from "../lib/session-view";
 import { ago, elapsed } from "../lib/time";
+import { useVault } from "../vault/VaultProvider";
+import { shareWith } from "../vault/share-with";
 
 function CommentBody({ body, members }: { body: string; members: Member[] }) {
   return (
@@ -77,6 +79,7 @@ export function Session() {
   const navigate = useNavigate();
   const assignmentRevision = useRef(0);
   const assignmentQueue = useRef<Promise<void>>(Promise.resolve());
+  const vault = useVault();
 
   const load = useCallback(async () => {
     try {
@@ -204,6 +207,15 @@ export function Session() {
     try {
       await request;
       if (assignmentRevision.current === revision) setError("");
+      /*
+       * Whoever is made responsible can open it straight away. The owner
+       * assigning from their own browser is the say-so, the same as sharing,
+       * and only the owner holds the password to seal.
+       */
+      const added = uids.filter((uid) => !previous.includes(uid));
+      if (session.ownerUid === you.uid && added.length > 0) {
+        void shareWith(vault, you.uid, session, members.filter((member) => added.includes(member.uid)));
+      }
     } catch (caught) {
       if (assignmentRevision.current === revision) {
         setDetail((current) => current ? {
diff --git a/app/src/routes/Team.tsx b/app/src/routes/Team.tsx
index c61d98a..7a74ac3 100644
--- a/app/src/routes/Team.tsx
+++ b/app/src/routes/Team.tsx
@@ -17,7 +17,6 @@ import { ago } from "../lib/time";
 import { Avatar } from "../components/Avatar";
 import { displayName } from "../lib/people";
 import { usePageTitle } from "../lib/page-title";
-import { publicKey } from "../lib/keypair";
 import { COPY_FAILED, useCopy } from "../lib/clipboard";
 import { SearchSelect } from "../components/SearchSelect";
 
@@ -112,7 +111,8 @@ export function Team() {
 
   const load = useCallback(async () => {
     try {
-      const result = await fetchOrg(undefined, await publicKey());
+      /* No browser key is published any more: colleagues seal to the vault. */
+      const result = await fetchOrg();
       setView(result);
       setDraftName(result.organization.name);
       setError("");
diff --git a/app/src/routes/Workspace.tsx b/app/src/routes/Workspace.tsx
index 833bdf0..1de609b 100644
--- a/app/src/routes/Workspace.tsx
+++ b/app/src/routes/Workspace.tsx
@@ -28,14 +28,17 @@ import {
   type SessionRecord,
 } from "../lib/api";
 import { generatePassword, sealPassword } from "../lib/seal";
-import { publicKey, sealForMembers } from "../lib/keypair";
 import { sealTargets } from "../lib/session-share";
-import { fetchOrg, shareSessionKeys } from "../lib/api";
+import { shareSessionKeys } from "../lib/api";
+import { keyTrust, trustKey } from "../lib/known-keys";
+import { isVaultShare } from "../lib/vault-crypto";
+import { useVault } from "../vault/VaultProvider";
+import { shareWith } from "../vault/share-with";
 import {
   adoptOrigin,
   audienceFor,
+  cachedPassword,
   forget,
-  passwordFor,
   rememberFor,
   rememberForOrigin,
 } from "../lib/session-passwords";
@@ -136,6 +139,16 @@ function writeViewMode(mode: ViewMode): void {
 export function Workspace() {
   usePageTitle("Sessions");
   const { user } = useAuth();
+  /*
+   * Through a ref, because the session list is loaded by a callback made
+   * once; the vault's functions are stable, but reading them fresh costs
+   * nothing and cannot go stale.
+   */
+  const vault = useVault();
+  const vaultRef = useRef(vault);
+  useEffect(() => {
+    vaultRef.current = vault;
+  }, [vault]);
   const [state, dispatch] = useReducer(reduce, EMPTY);
   const [sessions, setSessions] = useState<SessionRecord[] | null>(null);
   const [devices, setDevices] = useState<Device[]>([]);
@@ -170,6 +183,8 @@ export function Workspace() {
   const pendingShares = useRef(new Map<string, string>());
   /* Who each session has already been shared with, so polling is not chatty. */
   const sharedWith = useRef(new Map<string, Set<string>>());
+  /* Sessions whose cached password has been checked against the vault on this page. */
+  const checkedVault = useRef(new Set<string>());
   /* Keeps rapid multi-select ticks ordered without disabling the picker. */
   const assignmentQueue = useRef(new Map<string, Promise<{ session: SessionRecord }>>());
 
@@ -258,16 +273,6 @@ export function Workspace() {
     });
   }, [state, user]);
 
-  /*
-   * Publishing this browser's key makes it a possible recipient of a session
-   * password sealed by a colleague.
-   */
-  useEffect(() => {
-    void publicKey()
-      .then((key) => fetchOrg(undefined, key))
-      .catch(() => undefined);
-  }, []);
-
   /*
    * Machines are polled, not fetched once: whether a machine is reachable is a
    * live fact, and a stale snapshot silently disables the Start button.
@@ -297,27 +302,32 @@ export function Workspace() {
 
     /*
      * Choose the password here and seal it to the machine. The service relays
-     * an envelope it cannot open, and this browser keeps the only other copy,
-     * so a session started here opens without asking for something the person
-     * who started it was never shown.
+     * an envelope it cannot open; the CLI seals its own copy to the vault when
+     * the session registers, and this browser caches one meanwhile. So a
+     * session started here opens anywhere without asking for something the
+     * person who started it was never shown.
      */
     const device = devices.find((candidate) => candidate.id === input.deviceId);
-    let sealed: { senderPublicKey: string; sealedPassword: string } | undefined;
-    let password = "";
-    if (device?.agentPublicKey) {
-      password = generatePassword();
-      sealed = await sealPassword(device.agentPublicKey, password);
+    /*
+     * A machine with no key to seal to would start the session under a
+     * password nobody is ever shown, which is a session nobody can open. The
+     * modal already refuses; this is the backstop.
+     */
+    if (!device?.agentPublicKey) {
+      throw new Error(
+        `${device?.label ?? "That machine"} cannot receive a password yet. Update shell there, then try again.`,
+      );
     }
+    const password = generatePassword();
+    const sealed = await sealPassword(device.agentPublicKey, password);
 
     const queued = await startSession({ ...input, ...sealed });
-    if (password) {
-      rememberForOrigin(queued.command.id, password, input.share);
-      /*
-       * Held here until the session exists to attach the password to. The
-       * colleagues chosen above are sealed to on the poll that finds it.
-       */
-      pendingShares.current.set(queued.command.id, password);
-    }
+    rememberForOrigin(queued.command.id, password, input.share);
+    /*
+     * Held here until the session exists to attach the password to. The
+     * colleagues chosen above are sealed to on the poll that finds it.
+     */
+    pendingShares.current.set(queued.command.id, password);
     /*
      * The machine has to poll, launch, and publish, so the row shows up a
      * moment later rather than on this response.
@@ -391,9 +401,47 @@ export function Workspace() {
    * between starting a session and it appearing still has sealing to do.
    */
   async function shareAnyPending(all: SessionRecord[], roster: Member[], me: Member | null) {
-    for (const session of all) {
-      if (session.closedAt) continue;
+    const vault = vaultRef.current;
+
+    /*
+     * Makes sure the vault holds this person's copy of a session's password,
+     * from whatever this browser already has. True once there is nothing left
+     * to do for the session, so it is not looked at again on this page.
+     *
+     * This is also the migration for everything from before the vault, so it
+     * runs for every session on every page until it is done, and each step is
+     * safe to repeat: it compares with what the vault holds and writes only
+     * when that is missing or known to be wrong. Sources, best first:
+     *
+     * - a password cached here and known to be right, because this browser
+     *   chose it or it opened the session. It replaces a vault copy that
+     *   differs, since a session has one password and this one is proven;
+     * - a copy a colleague sealed to this browser's key before the vault. The
+     *   service holds it in the slot the vault copy takes, so keeping it is
+     *   moving it;
+     * - a password cached before the vault, with no record of whether it
+     *   worked. Kept only when the vault has nothing, since a guess must never
+     *   replace a copy that may be right.
+     *
+     * A password typed since and not yet proven waits: the terminal pane keeps
+     * it the moment it opens the session.
+     */
+    async function keepOwnCopy(session: SessionRecord): Promise<boolean> {
+      const share = session.keyShare;
+      const inVault = isVaultShare(share?.sealed) ? await vault.openShare(session.id, share) : null;
+      const cached = cachedPassword(session.id);
+      if (cached?.verified) {
+        return cached.password === inVault || vault.keep(session.id, cached.password);
+      }
+      if (inVault) return true;
+      const legacyShare = share && !isVaultShare(share.sealed) ? await vault.openShare(session.id, share) : null;
+      const candidate = legacyShare ?? (cached?.legacy ? cached.password : null);
+      if (candidate) return vault.keep(session.id, candidate);
+      /* Nothing here, or only an unproven guess the pane will settle. */
+      return !cached;
+    }
 
+    for (const session of all) {
       /* Newly started here, still waiting for its session to appear. */
       const pending = session.origin ? pendingShares.current.get(session.origin) : undefined;
       if (pending) {
@@ -401,11 +449,27 @@ export function Workspace() {
         rememberFor(session.id, pending);
       }
 
-      /* Only the owner holds the password, so only they can share it. */
-      if (me && session.ownerUid !== me.uid) continue;
-      const password = passwordFor(session.id);
-      if (!password) continue;
+      /*
+       * Finished sessions too: a persistent one comes back under the same
+       * password, so its copy is worth keeping.
+       */
+      if (!checkedVault.current.has(session.id) && (await keepOwnCopy(session))) {
+        checkedVault.current.add(session.id);
+      }
 
+      if (session.closedAt) continue;
+      const cached = cachedPassword(session.id);
+
+      /* Only the owner shares with colleagues. */
+      if (!me || session.ownerUid !== me.uid) continue;
+      /*
+       * Only people chosen in this browser: at start, by sharing, or by the
+       * owner assigning them here. Never the service's assignee list on its
+       * own. Owners and admins can assign anyone to any session, themselves
+       * included, so sealing to whoever it names would let them read sessions
+       * nobody shared with them. Those are offered to the owner on the
+       * session page instead.
+       */
       const missing = sealTargets({
         members: roster,
         you: me,
@@ -413,22 +477,31 @@ export function Workspace() {
         done: sharedWith.current.get(session.id),
       });
       if (missing.length === 0) continue;
+      /* A proven password before a vault copy nobody can vouch for; see TerminalPane. */
+      const password =
+        (cached?.verified ? cached.password : null) ?? (await vault.openShare(session.id, session.keyShare));
+      if (!password) continue;
 
-      try {
-        const shares = await sealForMembers(missing, password);
-        await shareSessionKeys(
-          session.id,
-          shares.map((share) => ({
-            uid: share.uid,
-            sender_public_key: share.senderPublicKey,
-            sealed: share.sealed,
-          })),
-        );
-        const done = sharedWith.current.get(session.id) ?? new Set<string>();
-        for (const share of shares) done.add(share.uid);
-        sharedWith.current.set(session.id, done);
-      } catch {
-        /* Sharing is a convenience; the session still works for its owner. */
+      const done = sharedWith.current.get(session.id) ?? new Set<string>();
+      sharedWith.current.set(session.id, done);
+      for (const member of missing) {
+        /*
+         * Sealed without asking only to a key this browser has sealed to
+         * before, or is seeing for the first time. One that changed waits for
+         * the owner to confirm it on the session page.
+         */
+        if (!member.accountKey || keyTrust(me.uid, member.uid, member.accountKey) === "changed") continue;
+        try {
+          const share = await vault.sealTo(member, session.id, password);
+          if (!share) continue;
+          await shareSessionKeys(session.id, [
+            { uid: member.uid, sender_public_key: share.senderPublicKey, sealed: share.sealed },
+          ]);
+          trustKey(me.uid, member.uid, member.accountKey);
+          done.add(member.uid);
+        } catch {
+          /* Sharing is a convenience; the session still works for its owner. */
+        }
       }
     }
   }
@@ -453,6 +526,20 @@ export function Workspace() {
       setSessions((current) => current?.map(
         (entry) => entry.id === updated.id ? updated : entry,
       ) ?? null);
+      /*
+       * Whoever is made responsible can open it straight away. The owner
+       * assigning from their own browser is the say-so, the same as sharing,
+       * and only the owner holds the password to seal.
+       */
+      const added = uids.filter((uid) => !previous.includes(uid));
+      if (you && session.ownerUid === you.uid && added.length > 0) {
+        void shareWith(
+          vaultRef.current,
+          you.uid,
+          session,
+          members.filter((member) => added.includes(member.uid)),
+        );
+      }
       const names = members
         .filter((member) => uids.includes(member.uid))
         .map((member) => member.name || member.email);
@@ -583,6 +670,7 @@ export function Workspace() {
                 shareUrl={tab.shareUrl}
                 active={state.activeId === tab.id}
                 keyShare={current?.keyShare ?? tab.keyShare}
+                host={current?.host}
                 canType={current ? canEdit(current, you) : tab.canType}
               />
             );
diff --git a/app/src/styles/auth.css b/app/src/styles/auth.css
index fabe047..945d474 100644
--- a/app/src/styles/auth.css
+++ b/app/src/styles/auth.css
@@ -1069,6 +1069,14 @@
     flex-direction: column-reverse;
   }
 
+  /*
+   * In a column, `flex: 1` sets the height basis to zero and the buttons
+   * collapse to the height of their text. Stacked, they take their own height.
+   */
+  .consent-actions .btn {
+    flex: none;
+  }
+
   .session {
     align-items: flex-start;
     flex-direction: column;
diff --git a/app/src/styles/vault.css b/app/src/styles/vault.css
new file mode 100644
index 0000000..8a10aa0
--- /dev/null
+++ b/app/src/styles/vault.css
@@ -0,0 +1,204 @@
+/* The session vault: setting it up, unlocking it, and its row on Account. */
+
+.vault-card {
+  gap: 16px;
+}
+
+.vault-form {
+  display: grid;
+  gap: 12px;
+  margin-top: 14px;
+}
+
+.vault-label {
+  font-size: 0.82rem;
+  font-weight: 600;
+  color: var(--ink-soft);
+}
+
+.vault-key-block {
+  display: grid;
+  gap: 10px;
+  padding: 16px;
+  border: 1px solid var(--line-strong);
+  border-radius: var(--radius-control);
+  background: var(--paper);
+}
+
+/* Eight groups of four, wrapping as a grid so a phone never splits a group. */
+.vault-key {
+  display: grid;
+  grid-template-columns: repeat(4, max-content);
+  gap: 6px 14px;
+  font-family: var(--mono);
+  font-size: 1.12rem;
+  letter-spacing: 0.08em;
+  color: var(--ink);
+  user-select: all;
+}
+
+.vault-key-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+
+.vault-key-actions .btn {
+  flex: 1 1 8rem;
+  width: auto;
+}
+
+.vault-note {
+  display: flex;
+  gap: 8px;
+  align-items: flex-start;
+  font-size: 0.85rem;
+  line-height: 1.5;
+  color: var(--muted);
+}
+
+.vault-note svg {
+  flex: none;
+  margin-top: 3px;
+}
+
+.vault-input {
+  width: 8ch;
+  padding: 9px 12px;
+  font: 500 1rem/1.2 var(--mono);
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  color: var(--ink);
+  background: var(--white);
+  border: 1px solid var(--line-strong);
+  border-radius: var(--radius-control);
+}
+
+/* A whole key is 39 characters, so it wraps at its dashes rather than scrolling. */
+.vault-input-wide {
+  width: 100%;
+  line-height: 1.5;
+  letter-spacing: 0.04em;
+  resize: none;
+  overflow-wrap: anywhere;
+}
+
+.vault-input:focus-visible {
+  outline: 2px solid var(--blue);
+  outline-offset: 1px;
+}
+
+.vault-link {
+  margin-left: 12px;
+  padding: 0;
+  font: inherit;
+  color: var(--muted);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+  background: none;
+  border: 0;
+  cursor: pointer;
+}
+
+.vault-link:hover {
+  color: var(--ink);
+}
+
+.vault-lost {
+  margin-top: 8px;
+  padding-top: 14px;
+  border-top: 1px solid var(--line);
+  font-size: 0.88rem;
+  color: var(--muted);
+}
+
+.vault-lost summary {
+  cursor: pointer;
+  color: var(--ink-soft);
+}
+
+.vault-lost[open] {
+  display: grid;
+  gap: 10px;
+}
+
+.vault-lost p {
+  margin: 0;
+  line-height: 1.55;
+}
+
+.vault-fingerprint {
+  font-family: var(--mono);
+  letter-spacing: 0.04em;
+}
+
+.vault-reset {
+  margin-top: 20px;
+}
+
+/* Assignees who cannot open the session yet, each with the way to let them. */
+.audience-assigned {
+  display: grid;
+  gap: 6px;
+  margin: 10px 0 0;
+  padding: 0;
+  list-style: none;
+  font-size: 0.86rem;
+  color: var(--muted);
+}
+
+.audience-assigned li {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: baseline;
+  gap: 4px 10px;
+}
+
+/* Under the password gate: where a terminal-started session's password is. */
+.pane-gate-hint {
+  font-size: 0.82rem;
+  line-height: 1.5;
+  color: var(--muted);
+}
+
+.pane-gate-hint code {
+  font-family: var(--mono);
+  font-size: 0.95em;
+}
+
+/* A colleague whose vault key changed, held until the owner says go ahead. */
+.audience-confirm {
+  display: grid;
+  gap: 10px;
+  margin-top: 12px;
+  padding: 12px 14px;
+  border-radius: var(--radius-control);
+  background: var(--danger-wash);
+  color: var(--ink);
+  font-size: 0.86rem;
+  line-height: 1.5;
+}
+
+.audience-confirm p {
+  display: flex;
+  gap: 8px;
+  margin: 0;
+}
+
+.audience-confirm svg {
+  flex: none;
+  margin-top: 3px;
+  color: var(--danger);
+}
+
+.audience-confirm-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+
+@media (max-width: 420px) {
+  .vault-key {
+    grid-template-columns: repeat(2, max-content);
+  }
+}
diff --git a/app/src/terminal/TerminalPane.tsx b/app/src/terminal/TerminalPane.tsx
index 7cd1e32..677ff11 100644
--- a/app/src/terminal/TerminalPane.tsx
+++ b/app/src/terminal/TerminalPane.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useRef, useState, type FormEvent, useMemo } from "react";
+import { useCallback, useEffect, useRef, useState, type FormEvent } from "react";
 import { Terminal } from "@xterm/xterm";
 import { ArrowClockwise, LockKey } from "@phosphor-icons/react";
 import "@xterm/xterm/css/xterm.css";
@@ -7,8 +7,9 @@ import { DESKTOP_TERMINAL_GRID, type TerminalGrid } from "./terminal-grid";
 import { fittedTerminal, type TerminalCell } from "./terminal-fit";
 import { cellMeasurer, terminalBox } from "./terminal-metrics";
 import { encryptionFragment, resolveSessionSocket, sessionIdFromShareUrl } from "./socket-url";
-import { forget, passwordFor, rememberFor } from "../lib/session-passwords";
-import { openSealed } from "../lib/keypair";
+import { cachedPassword, forgetUnverified, markVerified, rememberVerified } from "../lib/session-passwords";
+import { isVaultShare } from "../lib/vault-crypto";
+import { useVault } from "../vault/VaultProvider";
 import { AuditSink } from "./audit-sink";
 import { postAudit } from "../lib/api";
 import { Button } from "../components/Button";
@@ -26,6 +27,18 @@ export interface TerminalPaneProps {
    * the people responsible" means in a terminal.
    */
   canType?: boolean;
+  /** The machine running it, named in the hint when no password is at hand. */
+  host?: string;
+}
+
+/*
+ * One password to try, and where it came from. The source decides what a
+ * failure means: a password this browser only cached as a guess can be
+ * dropped, while one from the vault, or one that has worked before, is kept.
+ */
+interface Attempt {
+  source: "vault" | "cache" | "legacy" | "typed";
+  password: string;
 }
 
 const THEME = {
@@ -52,7 +65,18 @@ export function TerminalPane({
   active,
   keyShare,
   canType = true,
+  host,
 }: TerminalPaneProps) {
+  /*
+   * Read through a ref inside the effect that builds the terminal, so the
+   * vault changing state never tears down an open session.
+   */
+  const vault = useVault();
+  const vaultRef = useRef(vault);
+  vaultRef.current = vault;
+  /* The password being tried, and the ones still to try after it. */
+  const attempt = useRef<Attempt | null>(null);
+  const pending = useRef<Attempt[]>([]);
   const mount = useRef<HTMLDivElement>(null);
   const terminal = useRef<Terminal | null>(null);
   const measure = useRef<((fontSize: number) => TerminalCell) | null>(null);
@@ -119,25 +143,23 @@ export function TerminalPane({
   }, []);
 
   /*
-   * A stable identity for the sealed password.
-   *
-   * The sessions list is refetched every few seconds and every fetch builds
-   * new objects, so the keyShare prop is a different object each time even
-   * when the bytes are identical. It is in the dependency list of the effect
-   * below, which builds the terminal and opens the socket, so an unstable
-   * identity tears the terminal down and reconnects it on every poll. What
-   * matters is the content, so that is what is compared.
+   * The sealed password, read when the terminal is built rather than being a
+   * reason to build it again. The session list is refetched every few
+   * seconds, and a copy saved to the vault has different bytes every time it
+   * is sealed, so rebuilding on a change tore an open terminal down and put
+   * it back, scrollback and all. A share that arrives while the pane is still
+   * asking for a password is picked up by the effect after the one below.
    */
+  const shareRef = useRef(keyShare);
+  shareRef.current = keyShare;
   const sealed = keyShare ? `${keyShare.senderPublicKey}:${keyShare.sealed}` : "";
-  const stableShare = useMemo(
-    () => keyShare,
-    // eslint-disable-next-line react-hooks/exhaustive-deps -- content, not identity
-    [sealed],
-  );
+  /* Shares already tried in this pane, so one that does not open is not tried in a loop. */
+  const tried = useRef(new Set<string>());
 
   useEffect(() => {
     const node = mount.current;
     if (!node) return;
+    tried.current = new Set();
 
     /* A pane reused for another session starts from the default again. */
     grid.current = DESKTOP_TERMINAL_GRID;
@@ -176,19 +198,45 @@ export function TerminalPane({
       fragment: encryptionFragment(shareUrl),
       events: {
         onStatus: (next, message) => {
-          setStatus(next);
-          setDetail(message ?? "");
-          if (next === "needs-password") {
-            setUnlocking(false);
+          let shown = message;
+          if (next === "needs-password" && message) {
             /*
-             * A remembered password that no longer works is worse than none:
-             * it would retry forever. Drop it and let the person type one.
+             * An attempt failed. Only a cached guess is thrown away. A
+             * password from the vault, or one that has opened this session
+             * before, is kept: a frame can fail to open for reasons other than
+             * a wrong password, and deleting the only copy of a right one is
+             * how sessions used to be lost for good. A typed password was
+             * never written, so there is nothing of it to remove.
              */
-            if (message) {
-              const id = sessionIdFromShareUrl(shareUrl);
-              if (id) forget(id);
+            const failed = attempt.current;
+            attempt.current = null;
+            if (failed && sessionId && failed.source === "cache") {
+              forgetUnverified(sessionId, failed.password);
+            }
+            /* Another source may still hold the right one. */
+            if (tryNext()) return;
+            if (failed && failed.source !== "typed") {
+              shown = "The saved password did not open this session. Enter it to continue.";
             }
           }
+          setStatus(next);
+          setDetail(shown ?? "");
+          if (next === "needs-password") setUnlocking(false);
+        },
+        onUnlocked: () => {
+          const worked = attempt.current;
+          attempt.current = null;
+          pending.current = [];
+          if (!worked || !sessionId) return;
+          /* Written only now that it has proved itself; see handleUnlock. */
+          if (worked.source === "typed") rememberVerified(sessionId, worked.password);
+          if (worked.source === "cache") markVerified(sessionId, worked.password);
+          /*
+           * A password that opened the session but did not come from the
+           * vault goes into it now, so no browser has to be told it again.
+           * That includes one a colleague sealed to this browser's old key.
+           */
+          if (worked.source !== "vault") void keepIfMissing(sessionId, worked.password);
         },
         onData: (bytes, reset) => {
           if (reset) term.reset();
@@ -222,23 +270,60 @@ export function TerminalPane({
     });
     term.options.disableStdin = !canType;
 
+    const sessionId = sessionIdFromShareUrl(shareUrl);
+    attempt.current = null;
+    pending.current = [];
+
+    /* Submits the next password to try. False when none is left. */
+    function tryNext(): boolean {
+      const next = pending.current.shift();
+      if (!next) return false;
+      attempt.current = next;
+      void connected.submitPassword(next.password);
+      return true;
+    }
+
     /*
-     * A session this browser started already has its password here, so unlock
-     * without a prompt. Everything else still asks.
+     * Every password within reach is tried before anyone is asked. One this
+     * browser has already seen open the session goes first: a vault copy is
+     * sealed with an ephemeral key, so anyone holding the public key could
+     * have made one, and a proven password should not give way to a copy
+     * nobody can vouch for. Then the vault's copy, then a cached guess, then
+     * one a colleague sealed to this browser's old key. The gate appears only
+     * when all of them fail, or there are none.
      */
-    const sessionId = sessionIdFromShareUrl(shareUrl);
+    const initial = shareRef.current;
+    if (initial) tried.current.add(`${initial.senderPublicKey}:${initial.sealed}`);
     void connected.start().then(async () => {
-      if (!connected.needsPassword) return;
-      /* This browser's own copy, from starting the session here. */
-      const own = sessionId ? passwordFor(sessionId) : null;
-      if (own) return connected.submitPassword(own);
-      /* Otherwise a copy a colleague sealed to this browser. */
-      if (stableShare) {
-        const shared = await openSealed(stableShare.senderPublicKey, stableShare.sealed);
-        if (shared) return connected.submitPassword(shared);
-      }
+      if (!connected.needsPassword || !sessionId) return;
+      const found: Attempt[] = [];
+      const add = (source: Attempt["source"], password: string | null | undefined) => {
+        if (password && !found.some((entry) => entry.password === password)) found.push({ source, password });
+      };
+      const opener = vaultRef.current;
+      const cached = cachedPassword(sessionId);
+      if (cached?.verified) add("cache", cached.password);
+      if (initial && isVaultShare(initial.sealed)) add("vault", await opener.openShare(sessionId, initial));
+      add("cache", cached?.password);
+      if (initial && !isVaultShare(initial.sealed)) add("legacy", await opener.openShare(sessionId, initial));
+      pending.current = found;
+      tryNext();
     });
 
+    /*
+     * Seals a password that worked into the vault, unless the vault already
+     * holds exactly this one. Sealing is never byte-for-byte repeatable, so
+     * doing it regardless would rewrite the share on every open. Only a vault
+     * share counts as held: one sealed to an old browser key is the thing
+     * being moved into the vault.
+     */
+    async function keepIfMissing(id: string, password: string): Promise<void> {
+      const opener = vaultRef.current;
+      const share = shareRef.current;
+      if (share && isVaultShare(share.sealed) && (await opener.openShare(id, share)) === password) return;
+      await opener.keep(id, password);
+    }
+
     const observer = new ResizeObserver(() => refit());
     observer.observe(node);
     const frame = requestAnimationFrame(refit);
@@ -254,7 +339,27 @@ export function TerminalPane({
       measure.current = null;
       connection.current = null;
     };
-  }, [shareUrl, refit, canType, stableShare]);
+  }, [shareUrl, refit, canType]);
+
+  /*
+   * A share that arrives while the pane is asking for a password, such as the
+   * CLI's own copy landing a moment after the session appears, is tried
+   * without anyone having to reload. Each share is tried once.
+   */
+  useEffect(() => {
+    const share = shareRef.current;
+    const id = sessionIdFromShareUrl(shareUrl);
+    if (status !== "needs-password" || !share || !id || attempt.current) return;
+    const key = `${share.senderPublicKey}:${share.sealed}`;
+    if (tried.current.has(key)) return;
+    tried.current.add(key);
+    void vaultRef.current.openShare(id, share).then((password) => {
+      if (!password || !connection.current || attempt.current) return;
+      pending.current = [];
+      attempt.current = { source: isVaultShare(share.sealed) ? "vault" : "legacy", password };
+      void connection.current.submitPassword(password);
+    });
+  }, [sealed, status, shareUrl]);
 
   /* A hidden pane measures as zero, so it has to be refitted when it returns. */
   useEffect(() => {
@@ -272,15 +377,13 @@ export function TerminalPane({
     setUnlocking(true);
     setDetail("");
     /*
-     * Kept, so this is the last time it is typed for this session.
-     *
-     * A password only proves itself when a frame opens, which happens after
-     * this returns, so it is written now and removed by the failure path
-     * above if it turns out to be wrong. Storing it early costs a dead entry;
-     * not storing it at all is what made every reload ask again.
+     * Nothing is written until the password opens the session. Then it is
+     * cached as proven and sealed into the vault, so this is the last time it
+     * is typed for this session in any browser. A typo is simply forgotten,
+     * and never takes the place of a password that works.
      */
-    const sessionId = sessionIdFromShareUrl(shareUrl);
-    if (sessionId) rememberFor(sessionId, password);
+    pending.current = [];
+    attempt.current = { source: "typed", password };
     await connection.current.submitPassword(password);
     setPassword("");
   }
@@ -299,9 +402,16 @@ export function TerminalPane({
             </span>
             <h2>Enter the session password</h2>
             <p>
-              The password is used on this device to derive the key. It is never
-              sent to shell.online.
+              The password is used on this device to derive the key. Once it
+              opens the session it is sealed into your vault, which shell.online
+              cannot open, and you are not asked for it again.
             </p>
+            {host && (
+              <p className="pane-gate-hint">
+                Started in a terminal on <b>{host}</b>? Running{" "}
+                <code>shell sessions</code> there shows its password.
+              </p>
+            )}
             {detail && <Alert tone="error">{detail}</Alert>}
             <label htmlFor={`pw-${shareUrl}`}>Password</label>
             <input
diff --git a/app/src/terminal/connection.test.ts b/app/src/terminal/connection.test.ts
index 99d3cab..aeee1b8 100644
--- a/app/src/terminal/connection.test.ts
+++ b/app/src/terminal/connection.test.ts
@@ -349,6 +349,69 @@ describe("encrypted session", () => {
     expect(sent[0]).toBe(Opcode.Input);
     expect(new TextDecoder().decode(sent.subarray(1))).not.toContain("whoami");
   });
+
+  /*
+   * The first frame that opens is what proves a password right. The pane
+   * keeps a typed password, and seals it into the vault, only after this.
+   */
+  function watchUnlocks() {
+    const unlocked: number[] = [];
+    const statuses: { status: ConnectionStatus; detail?: string }[] = [];
+    const connection = new TerminalConnection({
+      url: "ws://localhost:5173/relay/api/sessions/x/ws",
+      fragment: SALT,
+      createSocket: (url) => new FakeSocket(url) as unknown as WebSocket,
+      events: {
+        onStatus: (status, detail) => statuses.push({ status, detail }),
+        onData: () => undefined,
+        onReadOnly: () => undefined,
+        onGrid: () => undefined,
+        onUnlocked: () => unlocked.push(1),
+      },
+    });
+    return { connection, unlocked, statuses };
+  }
+
+  it("says when a password first opens a frame, and only once", async () => {
+    const { connection, unlocked } = watchUnlocks();
+    await connection.start();
+    await connection.submitPassword("hunter2");
+    const cipher = await BrowserFrameCipher.fromPassword("hunter2", new Uint8Array(16).fill(7));
+    FakeSocket.last!.opened();
+    for (const text of ["one", "two"]) {
+      FakeSocket.last!.binary(await cipher.seal(encodeFrame(Opcode.Output, new TextEncoder().encode(text))));
+    }
+    await waitFor(() => unlocked.length > 0, "the first frame to open");
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    expect(unlocked).toHaveLength(1);
+  });
+
+  it("does not say so for a password that cannot decrypt", async () => {
+    const { connection, unlocked, statuses } = watchUnlocks();
+    await connection.start();
+    await connection.submitPassword("wrong");
+    const other = await BrowserFrameCipher.fromPassword("right", new Uint8Array(16).fill(7));
+    FakeSocket.last!.opened();
+    FakeSocket.last!.binary(await other.seal(encodeFrame(Opcode.Output, new TextEncoder().encode("x"))));
+    await waitFor(() => statuses.at(-1)?.status === "needs-password", "the failure");
+    expect(unlocked).toEqual([]);
+  });
+
+  it("asks a second password to prove itself again", async () => {
+    const { connection, unlocked, statuses } = watchUnlocks();
+    await connection.start();
+    await connection.submitPassword("wrong");
+    const right = await BrowserFrameCipher.fromPassword("right", new Uint8Array(16).fill(7));
+    FakeSocket.last!.opened();
+    FakeSocket.last!.binary(await right.seal(encodeFrame(Opcode.Output, new TextEncoder().encode("x"))));
+    await waitFor(() => statuses.at(-1)?.status === "needs-password", "the failure");
+
+    await connection.submitPassword("right");
+    FakeSocket.last!.opened();
+    FakeSocket.last!.binary(await right.seal(encodeFrame(Opcode.Output, new TextEncoder().encode("y"))));
+    await waitFor(() => unlocked.length > 0, "the right password to open a frame");
+    expect(unlocked).toHaveLength(1);
+  });
 });
 
 describe("the session grid", () => {
diff --git a/app/src/terminal/connection.ts b/app/src/terminal/connection.ts
index 8f5dd20..3ed574b 100644
--- a/app/src/terminal/connection.ts
+++ b/app/src/terminal/connection.ts
@@ -28,6 +28,11 @@ export interface ConnectionEvents {
    * joins or leaves.
    */
   onGrid(grid: TerminalGrid): void;
+  /**
+   * The key opened its first frame. Until then a password is only a guess, so
+   * this is the moment it can be kept as the right one.
+   */
+  onUnlocked?(): void;
 }
 
 export interface ConnectionOptions {
@@ -65,6 +70,8 @@ export class TerminalConnection {
   private stopped = false;
   private readOnly = false;
   private awaitingPassword = false;
+  /* Whether the current key has opened a frame yet. */
+  private proven = false;
   private waitingForCapacity = false;
   private currentGrid: TerminalGrid = DESKTOP_TERMINAL_GRID;
 
@@ -117,6 +124,7 @@ export class TerminalConnection {
     if (this.descriptor?.kind !== "password") return;
     this.cipher = await BrowserFrameCipher.fromPassword(password, this.descriptor.salt);
     this.awaitingPassword = false;
+    this.proven = false;
     this.open();
   }
 
@@ -221,6 +229,10 @@ export class TerminalConnection {
       if (!this.cipher) return;
       try {
         frame = await this.cipher.open(received);
+        if (!this.proven) {
+          this.proven = true;
+          this.options.events.onUnlocked?.();
+        }
       } catch {
         /*
          * A frame that will not open means the derived key is wrong. Drop it,
diff --git a/app/src/vault/VaultGate.tsx b/app/src/vault/VaultGate.tsx
new file mode 100644
index 0000000..1a7c60c
--- /dev/null
+++ b/app/src/vault/VaultGate.tsx
@@ -0,0 +1,301 @@
+import { useEffect, useRef, useState, type FormEvent, type ReactNode } from "react";
+import { Check, Copy, DownloadSimple, Key, LockKey, ShieldCheck, Warning } from "@phosphor-icons/react";
+import { Wordmark } from "../components/Wordmark";
+import { Button } from "../components/Button";
+import { Alert } from "../components/Alert";
+import { Booting } from "../components/Booting";
+import { useAuth } from "../auth/AuthProvider";
+import { COPY_FAILED, useCopy } from "../lib/clipboard";
+import { useVault, type PreparedVault } from "./VaultProvider";
+
+/**
+ * Stands in front of everything that reads or seals a session password.
+ *
+ * The vault is required. Without one a session's password lives in a single
+ * browser again, and a session started in a terminal cannot open here without
+ * someone typing its password. So setting it up is a one-time step on the way
+ * to the sessions page, not an option somewhere in settings.
+ */
+export function VaultGate({ children }: { children: ReactNode }) {
+  const vault = useVault();
+  if (vault.status === "unlocked") return <>{children}</>;
+  if (vault.status === "loading") return <Booting label="Opening your vault" />;
+  if (vault.status === "error") {
+    return (
+      <VaultFrame>
+        <span className="consent-mark" aria-hidden="true">
+          <Warning size={22} />
+        </span>
+        <h1>Your vault could not be reached</h1>
+        <p>{vault.error}</p>
+        <div className="consent-actions">
+          <Button type="button" onClick={vault.retry}>
+            Try again
+          </Button>
+        </div>
+      </VaultFrame>
+    );
+  }
+  if (vault.status === "setup") {
+    return (
+      <VaultFrame>
+        <VaultSetup reset={false} />
+      </VaultFrame>
+    );
+  }
+  return (
+    <VaultFrame>
+      <VaultUnlock />
+    </VaultFrame>
+  );
+}
+
+function VaultFrame({ children }: { children: ReactNode }) {
+  const { user, signOutUser } = useAuth();
+  return (
+    <main className="consent">
+      <header className="consent-head">
+        <Wordmark />
+        <span className="consent-account">
+          {user?.email}
+          {/* The gate is on the way in, so it has to have a way out too. */}
+          <button type="button" className="vault-link" onClick={() => void signOutUser()}>
+            Sign out
+          </button>
+        </span>
+      </header>
+      <section className="consent-card vault-card rise rise-1">{children}</section>
+    </main>
+  );
+}
+
+/**
+ * Makes a vault, shows its recovery key, and only saves it once the key has
+ * been confirmed. A vault whose key nobody kept cannot be opened anywhere
+ * else, so the order matters: nothing is sent until the last group is typed.
+ */
+export function VaultSetup({ reset, onDone }: { reset: boolean; onDone?: () => void }) {
+  const vault = useVault();
+  const { user } = useAuth();
+  const [prepared, setPrepared] = useState<PreparedVault | null>(null);
+  const [confirm, setConfirm] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+  const { copiedKey, failedKey, copy } = useCopy<"key">();
+  const started = useRef(false);
+
+  useEffect(() => {
+    /* Once: a second key pair would silently replace the key being shown. */
+    if (started.current) return;
+    started.current = true;
+    vault
+      .prepare(reset)
+      .then(setPrepared)
+      .catch((caught) => setError(caught instanceof Error ? caught.message : "Could not make a vault here."));
+  }, [vault, reset]);
+
+  const groups = prepared?.recoveryKey.split("-") ?? [];
+  const lastGroup = groups.at(-1) ?? "";
+  const confirmed = confirm.trim().toUpperCase() === lastGroup && lastGroup !== "";
+
+  function download() {
+    if (!prepared) return;
+    const text = [
+      "shell.online recovery key",
+      "",
+      prepared.recoveryKey,
+      "",
+      `Account: ${user?.email ?? ""}`,
+      `Made: ${new Date().toISOString().slice(0, 10)}`,
+      "",
+      "This key opens your session vault in a new browser.",
+      "shell.online does not have a copy and cannot recover it.",
+      "",
+    ].join("\n");
+    const url = URL.createObjectURL(new Blob([text], { type: "text/plain" }));
+    const link = document.createElement("a");
+    link.href = url;
+    link.download = "shell-online-recovery-key.txt";
+    link.click();
+    URL.revokeObjectURL(url);
+  }
+
+  async function handleSubmit(event: FormEvent) {
+    event.preventDefault();
+    if (!prepared || !confirmed) return;
+    setBusy(true);
+    setError("");
+    try {
+      await vault.commit(prepared);
+      onDone?.();
+    } catch (caught) {
+      setError(caught instanceof Error ? caught.message : "Could not save your vault.");
+      setBusy(false);
+    }
+  }
+
+  return (
+    <>
+      <span className="consent-mark" aria-hidden="true">
+        <ShieldCheck size={22} />
+      </span>
+      <h1>{reset ? "Make a new vault" : "Set up your session vault"}</h1>
+      <p>
+        Every session is end-to-end encrypted with its own password. Your vault
+        keeps those passwords sealed, so a session opens on any browser you
+        unlock, including ones started in a terminal. shell.online cannot open
+        your vault.
+      </p>
+
+      {reset && (
+        <Alert tone="error">
+          Passwords sealed to your old vault can no longer be opened. Running
+          sessions this browser can still read move across. Machines linked
+          with <code>shell login</code> need to sign in again before they save
+          to the new vault.
+        </Alert>
+      )}
+
+      {error && <Alert tone="error">{error}</Alert>}
+
+      {prepared && (
+        <form className="vault-form" onSubmit={handleSubmit}>
+          <div className="vault-key-block">
+            <span className="vault-label">Your recovery key</span>
+            <code className="vault-key" aria-label="Recovery key">
+              {groups.map((group, index) => (
+                <span key={index}>{group}</span>
+              ))}
+            </code>
+            <div className="vault-key-actions">
+              <Button type="button" variant="ghost" onClick={() => void copy(prepared.recoveryKey, "key")}>
+                {copiedKey === "key" ? <Check size={15} weight="bold" /> : <Copy size={15} />}
+                {copiedKey === "key" ? "Copied" : "Copy"}
+              </Button>
+              <Button type="button" variant="ghost" onClick={download}>
+                <DownloadSimple size={15} />
+                Download
+              </Button>
+            </div>
+            {failedKey && <p className="vault-note">{COPY_FAILED}</p>}
+          </div>
+
+          <p className="vault-note">
+            <Key size={14} weight="bold" />
+            <span>
+              This is the only way into your vault from a new browser. Keep it
+              in a password manager or somewhere offline. shell.online does not
+              have a copy and cannot recover it for you.
+            </span>
+          </p>
+
+          <label className="vault-label" htmlFor="vault-confirm">
+            Type the last group of four to confirm you saved it
+          </label>
+          <input
+            id="vault-confirm"
+            className="vault-input"
+            value={confirm}
+            onChange={(event) => setConfirm(event.target.value)}
+            autoComplete="off"
+            autoCapitalize="characters"
+            spellCheck={false}
+            maxLength={4}
+            placeholder="XXXX"
+          />
+
+          <div className="consent-actions">
+            <Button type="submit" busy={busy} busyLabel="Saving" disabled={!confirmed || busy}>
+              {reset ? "Replace my vault" : "Turn on my vault"}
+            </Button>
+          </div>
+        </form>
+      )}
+    </>
+  );
+}
+
+/** Opens an existing vault in a browser that has not opened it before. */
+function VaultUnlock() {
+  const vault = useVault();
+  const [text, setText] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+  const [resetting, setResetting] = useState(false);
+
+  if (resetting) return <VaultSetup reset />;
+
+  async function handleSubmit(event: FormEvent) {
+    event.preventDefault();
+    if (!text.trim()) return;
+    setBusy(true);
+    setError("");
+    try {
+      await vault.unlock(text);
+    } catch (caught) {
+      setError(caught instanceof Error ? caught.message : "Could not unlock your vault.");
+      setBusy(false);
+    }
+  }
+
+  return (
+    <>
+      <span className="consent-mark" aria-hidden="true">
+        <LockKey size={22} />
+      </span>
+      <h1>Unlock your session vault</h1>
+      <p>
+        This browser has not opened your vault yet. Enter the recovery key you
+        saved when you set it up. The key is used here to open the vault and is
+        never sent to shell.online.
+      </p>
+
+      {error && <Alert tone="error">{error}</Alert>}
+
+      <form className="vault-form" onSubmit={handleSubmit}>
+        <label className="vault-label" htmlFor="vault-recovery">
+          Recovery key
+        </label>
+        {/*
+          Two lines, so the whole key is in view on a phone: a single line
+          scrolled most of it out of sight, which is no way to check it.
+        */}
+        <textarea
+          id="vault-recovery"
+          className="vault-input vault-input-wide"
+          rows={2}
+          value={text}
+          onChange={(event) => setText(event.target.value)}
+          onKeyDown={(event) => {
+            if (event.key === "Enter") {
+              event.preventDefault();
+              event.currentTarget.form?.requestSubmit();
+            }
+          }}
+          autoComplete="off"
+          autoCapitalize="characters"
+          spellCheck={false}
+          placeholder="Paste or type your recovery key"
+        />
+        <div className="consent-actions">
+          <Button type="submit" busy={busy} busyLabel="Unlocking" disabled={busy || !text.trim()}>
+            Unlock
+          </Button>
+        </div>
+      </form>
+
+      <details className="vault-lost">
+        <summary>Lost your recovery key?</summary>
+        <p>
+          You can make a new vault. Passwords sealed to the old one cannot be
+          opened again, which is what keeps them out of anyone else&apos;s reach
+          too. A session that is still running can be reopened with{" "}
+          <code>shell sessions</code> on the machine running it.
+        </p>
+        <Button type="button" variant="ghost" onClick={() => setResetting(true)}>
+          Make a new vault
+        </Button>
+      </details>
+    </>
+  );
+}
diff --git a/app/src/vault/VaultProvider.tsx b/app/src/vault/VaultProvider.tsx
new file mode 100644
index 0000000..2d883d3
--- /dev/null
+++ b/app/src/vault/VaultProvider.tsx
@@ -0,0 +1,317 @@
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+import { useAuth } from "../auth/AuthProvider";
+import { fetchSessions, fetchVault, saveVault, shareSessionKeys, type VaultRecord } from "../lib/api";
+import {
+  createVault,
+  fingerprint,
+  isVaultShare,
+  openFromAccount,
+  openVault,
+  parseRecoveryKey,
+  sealToAccount,
+  VaultError,
+  type OpenedVault,
+  type SealedShare,
+  type VaultBundle,
+} from "../lib/vault-crypto";
+import { clearLocalVault, loadLocalVault, saveLocalVault } from "../lib/vault-store";
+import { openSealed } from "../lib/keypair";
+
+/**
+ * The signed-in person's session vault, and what is open in this browser.
+ *
+ * "setup" means the account has no vault yet; "locked" means it has one this
+ * browser has not opened; "unlocked" means a key that opens it is held here.
+ * Everything that reads or seals a session password goes through this, so
+ * there is one place that decides which key is used for what.
+ */
+export type VaultStatus = "loading" | "setup" | "locked" | "unlocked" | "error";
+
+/** A vault made in this browser and not yet handed to the service. */
+export interface PreparedVault {
+  bundle: VaultBundle;
+  recoveryKey: string;
+  opened: OpenedVault;
+  /** The version a reset replaces. Absent when setting up the first vault. */
+  replaces?: number;
+}
+
+interface VaultValue {
+  status: VaultStatus;
+  error: string;
+  /**
+   * The vault's public key as this browser verified it when unlocking, not as
+   * the service last described it. This is what is handed to the CLI.
+   */
+  publicKey: string | null;
+  /** A short form of the public key, for comparing with what the CLI prints. */
+  fingerprint: string;
+  /** False when this browser could not keep the unlocked vault, as in a private window. */
+  remembered: boolean;
+  /** The version on the service, when there is a vault at all. */
+  version: number | null;
+  prepare(reset: boolean): Promise<PreparedVault>;
+  commit(prepared: PreparedVault): Promise<void>;
+  unlock(recoveryKey: string): Promise<void>;
+  retry(): void;
+  /** Opens a password sealed to this person: to their vault, or to this browser's old key. */
+  openShare(sessionId: string, share: SealedShare | undefined): Promise<string | null>;
+  /** Seals a password to a colleague's vault. Null when they have none. */
+  sealTo(
+    recipient: { uid: string; accountKey?: string },
+    sessionId: string,
+    password: string,
+  ): Promise<SealedShare | null>;
+  /** Seals a password to this person's own vault and stores it. False when it could not. */
+  keep(sessionId: string, password: string): Promise<boolean>;
+}
+
+const VaultContext = createContext<VaultValue | null>(null);
+
+export function VaultProvider({ children }: { children: ReactNode }) {
+  const { user } = useAuth();
+  const uid = user?.uid ?? "";
+  const [status, setStatus] = useState<VaultStatus>("loading");
+  const [error, setError] = useState("");
+  const [remote, setRemote] = useState<VaultRecord | null>(null);
+  const [publicKey, setPublicKey] = useState<string | null>(null);
+  const [print, setPrint] = useState("");
+  const [remembered, setRemembered] = useState(true);
+  const [attempt, setAttempt] = useState(0);
+  /*
+   * Read by the callbacks below rather than closed over, so that unlocking
+   * does not hand every consumer new functions and tear down what they built
+   * with the old ones, such as an open terminal.
+   */
+  const opened = useRef<OpenedVault | null>(null);
+
+  const becomeUnlocked = useCallback(async (next: OpenedVault, kept: boolean) => {
+    opened.current = next;
+    setPublicKey(next.publicKey);
+    setPrint(await fingerprint(next.publicKey));
+    setRemembered(kept);
+    setError("");
+    setStatus("unlocked");
+  }, []);
+
+  useEffect(() => {
+    opened.current = null;
+    setPublicKey(null);
+    if (!uid) {
+      setStatus("loading");
+      setRemote(null);
+      return;
+    }
+    let live = true;
+    setStatus("loading");
+    void (async () => {
+      try {
+        const [{ vault }, local] = await Promise.all([fetchVault(), loadLocalVault(uid)]);
+        if (!live) return;
+        setRemote(vault);
+        if (!vault) {
+          if (local) await clearLocalVault(uid);
+          setStatus("setup");
+          return;
+        }
+        /*
+         * Only a key this browser unlocked itself counts, and only for the
+         * vault as it stands now. A reset elsewhere replaces the key pair, and
+         * sealing to a stale one would make passwords nobody can open.
+         */
+        if (local && local.publicKey === vault.publicKey && local.version === vault.version) {
+          await becomeUnlocked({ publicKey: local.publicKey, privateKey: local.privateKey }, true);
+          return;
+        }
+        setStatus("locked");
+      } catch (caught) {
+        if (!live) return;
+        setError(caught instanceof Error ? caught.message : "Could not reach your vault.");
+        setStatus("error");
+      }
+    })();
+    return () => {
+      live = false;
+    };
+  }, [uid, attempt, becomeUnlocked]);
+
+  const prepare = useCallback(
+    async (reset: boolean): Promise<PreparedVault> => {
+      const made = await createVault(uid);
+      return { ...made, replaces: reset && remote ? remote.version : undefined };
+    },
+    [uid, remote],
+  );
+
+  const commit = useCallback(
+    async (prepared: PreparedVault) => {
+      const previous = opened.current;
+      let vault: VaultRecord | null;
+      try {
+        vault = (await saveVault(prepared.bundle, prepared.replaces)).vault;
+      } catch (caught) {
+        /*
+         * Setting up is create-only on the service, so of two windows setting
+         * up at once the second is refused. Rather than leave it at a dead
+         * end, look again: in this browser the one that won is already
+         * unlocked, and anywhere else it asks for that window's key.
+         */
+        const winner = prepared.replaces === undefined
+          ? await fetchVault().then((result) => result.vault, () => null)
+          : null;
+        if (winner) {
+          setAttempt((value) => value + 1);
+          throw new VaultError(
+            "damaged",
+            "A vault was set up for this account in another window. Use the recovery key shown there.",
+          );
+        }
+        throw caught;
+      }
+      /* The service answers with what it stored; it must be what was sent. */
+      if (!vault || vault.publicKey !== prepared.bundle.publicKey) {
+        throw new VaultError("damaged", "The vault that was saved is not the one made here. Reload and try again.");
+      }
+      setRemote(vault);
+      const kept = await saveLocalVault({
+        uid,
+        publicKey: vault.publicKey,
+        version: vault.version,
+        privateKey: prepared.opened.privateKey,
+      });
+      await becomeUnlocked(prepared.opened, kept);
+
+      /*
+       * A reset made from a browser that still held the old vault can carry
+       * the passwords of running sessions across: it opens each with the old
+       * key and seals it to the new one. From anywhere else they are gone,
+       * which is what losing a recovery key has to mean.
+       */
+      if (previous && prepared.replaces !== undefined) {
+        await carryOver(uid, previous, prepared.opened);
+      }
+    },
+    [uid, becomeUnlocked],
+  );
+
+  const unlock = useCallback(
+    async (text: string) => {
+      if (!remote) throw new VaultError("damaged", "There is no vault to unlock. Reload and try again.");
+      const recovery = parseRecoveryKey(text);
+      if (!recovery) {
+        throw new VaultError(
+          "wrong-recovery-key",
+          "A recovery key is 32 letters and digits, in eight groups of four.",
+        );
+      }
+      try {
+        const next = await openVault(uid, remote, recovery);
+        const kept = await saveLocalVault({
+          uid,
+          publicKey: next.publicKey,
+          version: remote.version,
+          privateKey: next.privateKey,
+        });
+        await becomeUnlocked(next, kept);
+      } finally {
+        recovery.fill(0);
+      }
+    },
+    [uid, remote, becomeUnlocked],
+  );
+
+  const retry = useCallback(() => setAttempt((value) => value + 1), []);
+
+  const openShare = useCallback(
+    async (sessionId: string, share: SealedShare | undefined) => {
+      if (!share) return null;
+      if (isVaultShare(share.sealed)) {
+        const key = opened.current;
+        return key ? openFromAccount(key.privateKey, sessionId, uid, share) : null;
+      }
+      /* Shared before the vault existed, to the key this browser had then. */
+      return openSealed(share.senderPublicKey, share.sealed);
+    },
+    [uid],
+  );
+
+  const sealTo = useCallback(
+    async (recipient: { uid: string; accountKey?: string }, sessionId: string, password: string) => {
+      if (!recipient.accountKey) return null;
+      return sealToAccount(recipient.accountKey, sessionId, recipient.uid, password);
+    },
+    [],
+  );
+
+  const keep = useCallback(
+    async (sessionId: string, password: string) => {
+      /* The key this browser verified when it unlocked, not one fetched since. */
+      const key = opened.current;
+      if (!key) return false;
+      try {
+        const share = await sealToAccount(key.publicKey, sessionId, uid, password);
+        await shareSessionKeys(sessionId, [
+          { uid, sender_public_key: share.senderPublicKey, sealed: share.sealed },
+        ]);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    [uid],
+  );
+
+  const value = useMemo<VaultValue>(
+    () => ({
+      status,
+      error,
+      publicKey,
+      fingerprint: print,
+      remembered,
+      version: remote?.version ?? null,
+      prepare,
+      commit,
+      unlock,
+      retry,
+      openShare,
+      sealTo,
+      keep,
+    }),
+    [status, error, publicKey, print, remembered, remote, prepare, commit, unlock, retry, openShare, sealTo, keep],
+  );
+
+  return <VaultContext.Provider value={value}>{children}</VaultContext.Provider>;
+}
+
+async function carryOver(uid: string, previous: OpenedVault, next: OpenedVault): Promise<void> {
+  try {
+    const { sessions } = await fetchSessions();
+    /* Finished sessions too: a persistent one comes back under the same password. */
+    for (const session of sessions) {
+      if (!session.keyShare) continue;
+      const password = await openFromAccount(previous.privateKey, session.id, uid, session.keyShare);
+      if (!password) continue;
+      const share = await sealToAccount(next.publicKey, session.id, uid, password);
+      await shareSessionKeys(session.id, [
+        { uid, sender_public_key: share.senderPublicKey, sealed: share.sealed },
+      ]);
+    }
+  } catch {
+    /* Best effort. A session missed here still opens with `shell sessions`. */
+  }
+}
+
+export function useVault(): VaultValue {
+  const value = useContext(VaultContext);
+  if (!value) throw new Error("useVault must be used inside a VaultProvider.");
+  return value;
+}
diff --git a/app/src/vault/share-with.ts b/app/src/vault/share-with.ts
new file mode 100644
index 0000000..278103d
--- /dev/null
+++ b/app/src/vault/share-with.ts
@@ -0,0 +1,60 @@
+import { shareSessionKeys, type Member, type SessionRecord } from "../lib/api";
+import { addToAudience, cachedPassword } from "../lib/session-passwords";
+import { keyTrust, trustKey } from "../lib/known-keys";
+import type { useVault } from "./VaultProvider";
+
+type Vault = Pick<ReturnType<typeof useVault>, "openShare" | "sealTo">;
+
+/**
+ * Seals a session's password to colleagues its owner has just made
+ * responsible for it, so they can open it without anyone telling them the
+ * password.
+ *
+ * Skips anyone without a vault yet, and anyone whose vault key has changed
+ * since this browser last sealed to them: that is either a reset or a key
+ * that is not theirs, and it waits for the owner to confirm it on the session
+ * page. Returns who was sealed to.
+ */
+export async function shareWith(
+  vault: Vault,
+  owner: string,
+  session: Pick<SessionRecord, "id" | "keyShare">,
+  recipients: Member[],
+): Promise<string[]> {
+  /* A proven password before a vault copy nobody can vouch for; see TerminalPane. */
+  const cached = cachedPassword(session.id);
+  const password =
+    (cached?.verified ? cached.password : null) ?? (await vault.openShare(session.id, session.keyShare));
+  if (!password) return [];
+
+  const eligible = recipients.filter(
+    (recipient) =>
+      recipient.accountKey &&
+      recipient.uid !== owner &&
+      keyTrust(owner, recipient.uid, recipient.accountKey) !== "changed",
+  );
+  /*
+   * Recorded as chosen before sealing, not after, so a seal that fails is
+   * retried on the next poll: the audience is the owner's own choice, which
+   * the retry loop is allowed to act on.
+   */
+  if (eligible.length > 0) addToAudience(session.id, eligible.map((recipient) => recipient.uid));
+
+  const sealed: string[] = [];
+  for (const recipient of eligible) {
+    if (!recipient.accountKey) continue;
+    try {
+      const share = await vault.sealTo(recipient, session.id, password);
+      if (!share) continue;
+      await shareSessionKeys(session.id, [
+        { uid: recipient.uid, sender_public_key: share.senderPublicKey, sealed: share.sealed },
+      ]);
+      trustKey(owner, recipient.uid, recipient.accountKey);
+      sealed.push(recipient.uid);
+    } catch {
+      /* Left for the next attempt; the session page offers it again. */
+    }
+  }
+  if (sealed.length > 0) addToAudience(session.id, sealed);
+  return sealed;
+}
diff --git a/cmd/shell/main.go b/cmd/shell/main.go
index 19cd6da..00ad336 100644
--- a/cmd/shell/main.go
+++ b/cmd/shell/main.go
@@ -238,7 +238,7 @@ func run(arguments []string, stdout, stderr io.Writer) int {
 			Encrypted:  session.Encrypted,
 			Persistent: session.Persistent,
 			StartedAt:  processStartedAt.UnixMilli(),
-		})
+		}, password)
 		if isBackgroundChild() {
 			sendBackgroundResult(backgroundLaunchResult{
 				OK:         true,
diff --git a/cmd/shell/session_link.go b/cmd/shell/session_link.go
index b3a1951..3909c6d 100644
--- a/cmd/shell/session_link.go
+++ b/cmd/shell/session_link.go
@@ -55,6 +55,10 @@ type sessionLink struct {
 	accessToken string
 	sessionID   string
 	warn        io.Writer
+	// credentials and path are kept so a vault key seen for the first time
+	// can be pinned into the file it came from.
+	credentials account.Credentials
+	path        string
 }
 
 // openSessionLink loads credentials, refreshes them when stale, and returns a
@@ -91,14 +95,27 @@ func openSessionLink(ctx context.Context, warn io.Writer) *sessionLink {
 		}
 	}
 
-	return &sessionLink{client: client, accessToken: credentials.AccessToken, warn: warn}
+	return &sessionLink{
+		client:      client,
+		accessToken: credentials.AccessToken,
+		warn:        warn,
+		credentials: credentials,
+		path:        path,
+	}
 }
 
 // Register publishes the session. Failure is reported, never fatal.
-func (link *sessionLink) Register(ctx context.Context, input account.SessionInput) {
+//
+// password is the session's browser password, or empty when it has none. A
+// password is sealed to the account's vault so the session can be opened from
+// the web app after this terminal is gone; it is never sent any other way.
+func (link *sessionLink) Register(ctx context.Context, input account.SessionInput, password string) {
 	if link == nil {
 		return
 	}
+	if password != "" {
+		input.OwnerShare = link.vaultShare(ctx, input.ID, password)
+	}
 	if input.Host == "" {
 		if host, err := os.Hostname(); err == nil {
 			input.Host = host
@@ -132,6 +149,54 @@ func (link *sessionLink) Register(ctx context.Context, input account.SessionInpu
 	link.sessionID = input.ID
 }
 
+// vaultShare seals a session password to the account's vault key, or returns
+// nil when that cannot be done safely. Failing here costs only the saved copy;
+// the session itself is unaffected.
+//
+// The key is checked against the one this machine already trusts. The first
+// key seen is pinned; a different one later is refused, because the accounts
+// service is the thing that hands the key over and the thing that must not be
+// able to read what is sealed to it.
+func (link *sessionLink) vaultShare(ctx context.Context, sessionID, password string) *account.KeyShare {
+	const notSaved = "shell: this session's password was not saved to your vault"
+	if link.credentials.UID == "" {
+		fmt.Fprintf(link.warn, "%s: this machine's sign-in predates the vault; run 'shell login'\n", notSaved)
+		return nil
+	}
+
+	keyContext, cancel := context.WithTimeout(ctx, linkTimeout)
+	defer cancel()
+	fetched, ok, err := link.client.AccountKey(keyContext, link.accessToken)
+	if err != nil {
+		fmt.Fprintf(link.warn, "%s: %v\n", notSaved, err)
+		return nil
+	}
+	if !ok {
+		return nil
+	}
+
+	switch pinned := link.credentials.AccountKey; {
+	case pinned == "":
+		link.credentials.AccountKey = fetched
+		if saveErr := account.Save(link.path, link.credentials); saveErr != nil {
+			fmt.Fprintf(link.warn, "shell: could not remember your vault key: %v\n", saveErr)
+		}
+		fingerprint, _ := account.Fingerprint(fetched)
+		fmt.Fprintf(link.warn, "shell: saving session passwords to your vault (key %s)\n", fingerprint)
+	case pinned != fetched:
+		fmt.Fprintf(link.warn, "shell: your vault key changed since this machine signed in. "+
+			"Run 'shell login' to trust the new one; %s.\n", strings.TrimPrefix(notSaved, "shell: "))
+		return nil
+	}
+
+	sender, sealed, err := account.SealToAccount(link.credentials.AccountKey, sessionID, link.credentials.UID, password)
+	if err != nil {
+		fmt.Fprintf(link.warn, "%s: %v\n", notSaved, err)
+		return nil
+	}
+	return &account.KeyShare{SenderPublicKey: sender, Sealed: sealed}
+}
+
 // Close marks the session finished in the account.
 //
 // It deliberately uses a fresh background context: the process context is
diff --git a/cmd/shell/session_link_test.go b/cmd/shell/session_link_test.go
index d5ef643..79a202e 100644
--- a/cmd/shell/session_link_test.go
+++ b/cmd/shell/session_link_test.go
@@ -40,7 +40,7 @@ func TestOpenSessionLinkReturnsNilWhenNotSignedIn(t *testing.T) {
 func TestNilLinkMethodsAreSafe(t *testing.T) {
 	// The launch path calls these unconditionally, so nil must be inert.
 	var link *sessionLink
-	link.Register(context.Background(), sampleSessionInput())
+	link.Register(context.Background(), sampleSessionInput(), "")
 	exitCode := 0
 	link.Close(&exitCode)
 }
@@ -63,7 +63,7 @@ func TestRegisterPublishesTheSession(t *testing.T) {
 	if link == nil {
 		t.Fatal("expected a link for a signed-in machine")
 	}
-	link.Register(context.Background(), sampleSessionInput())
+	link.Register(context.Background(), sampleSessionInput(), "")
 
 	if authorization != "Bearer sha_access" {
 		t.Fatalf("Authorization = %q", authorization)
@@ -92,7 +92,7 @@ func TestRegisterWarnsButDoesNotFailTheLaunch(t *testing.T) {
 	linkedAccount(t, service.URL)
 	var warn bytes.Buffer
 	link := openSessionLink(context.Background(), &warn)
-	link.Register(context.Background(), sampleSessionInput())
+	link.Register(context.Background(), sampleSessionInput(), "")
 
 	if !strings.Contains(warn.String(), "will not appear in your account") {
 		t.Fatalf("warning = %q", warn.String())
@@ -113,7 +113,7 @@ func TestCloseIsSkippedWhenRegistrationNeverSucceeded(t *testing.T) {
 	linkedAccount(t, service.URL)
 	var warn bytes.Buffer
 	link := openSessionLink(context.Background(), &warn)
-	link.Register(context.Background(), sampleSessionInput())
+	link.Register(context.Background(), sampleSessionInput(), "")
 
 	exitCode := 0
 	link.Close(&exitCode)
@@ -141,7 +141,7 @@ func TestCloseMarksTheSessionFinished(t *testing.T) {
 	var warn bytes.Buffer
 	link := openSessionLink(context.Background(), &warn)
 	input := sampleSessionInput()
-	link.Register(context.Background(), input)
+	link.Register(context.Background(), input, "")
 
 	exitCode := 3
 	link.Close(&exitCode)
@@ -171,7 +171,7 @@ func TestCloseRunsEvenAfterTheProcessContextIsCancelled(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	var warn bytes.Buffer
 	link := openSessionLink(ctx, &warn)
-	link.Register(ctx, sampleSessionInput())
+	link.Register(ctx, sampleSessionInput(), "")
 	cancel()
 
 	exitCode := 0
@@ -217,7 +217,7 @@ func TestExpiredCredentialsAreRefreshedAndPersisted(t *testing.T) {
 	if link == nil {
 		t.Fatalf("expected a link after refresh; warnings %q", warn.String())
 	}
-	link.Register(context.Background(), sampleSessionInput())
+	link.Register(context.Background(), sampleSessionInput(), "")
 
 	if !refreshed.Load() {
 		t.Fatal("a stale access token should have been refreshed")
@@ -281,7 +281,7 @@ func TestSharingUsesTheServiceRecordedAtLoginNotTheEnvironment(t *testing.T) {
 	if link == nil {
 		t.Fatalf("a linked machine must produce a link; warnings %q", warn.String())
 	}
-	link.Register(context.Background(), sampleSessionInput())
+	link.Register(context.Background(), sampleSessionInput(), "")
 
 	if !reached {
 		t.Fatal("the share was not published to the service recorded at login")
@@ -319,7 +319,7 @@ func TestEveryShellInvocationPublishesOnALinkedMachine(t *testing.T) {
 		link := openSessionLink(context.Background(), &warn)
 		input := sampleSessionInput()
 		input.ID = id
-		link.Register(context.Background(), input)
+		link.Register(context.Background(), input, "")
 	}
 
 	if len(published) != 3 {
@@ -346,7 +346,7 @@ func TestPublishedLinkKeepsTheSaltSoItCanBeOpened(t *testing.T) {
 	link := openSessionLink(context.Background(), &warn)
 	input := sampleSessionInput()
 	input.ShareURL += "#salt=i6AaAzfYyklCDqgMRgEIDw"
-	link.Register(context.Background(), input)
+	link.Register(context.Background(), input, "")
 
 	if !strings.Contains(shareURL, "#salt=") {
 		t.Fatalf("a link without its salt cannot be opened from the web app: %q", shareURL)
diff --git a/cmd/shell/session_link_vault_test.go b/cmd/shell/session_link_vault_test.go
new file mode 100644
index 0000000..adf19ed
--- /dev/null
+++ b/cmd/shell/session_link_vault_test.go
@@ -0,0 +1,233 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/ecdh"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"shell.online/internal/account"
+)
+
+const vaultTestPassword = "Kw9eHbru"
+
+// vaultService stands in for the accounts service: it answers the key request
+// with keyStatus and records what each registration carried.
+type vaultService struct {
+	server    *httptest.Server
+	mu        sync.Mutex
+	keyAsks   int
+	published []map[string]any
+}
+
+func newVaultService(t *testing.T, keyStatus int, publicKey string) *vaultService {
+	t.Helper()
+	service := &vaultService{}
+	service.server = httptest.NewServer(http.HandlerFunc(
+		func(writer http.ResponseWriter, request *http.Request) {
+			service.mu.Lock()
+			defer service.mu.Unlock()
+			writer.Header().Set("Content-Type", "application/json")
+			switch request.URL.Path {
+			case "/api/account/key":
+				service.keyAsks++
+				writer.WriteHeader(keyStatus)
+				switch keyStatus {
+				case http.StatusOK:
+					_ = json.NewEncoder(writer).Encode(map[string]any{"public_key": publicKey, "version": 1})
+				case http.StatusNotFound:
+					_, _ = writer.Write([]byte(`{"error":"no vault"}`))
+				default:
+					_, _ = writer.Write([]byte(`{"error":"database down"}`))
+				}
+			case "/api/sessions":
+				var body map[string]any
+				_ = json.NewDecoder(request.Body).Decode(&body)
+				service.published = append(service.published, body)
+				writer.WriteHeader(http.StatusCreated)
+				_, _ = writer.Write([]byte(`{}`))
+			default:
+				http.NotFound(writer, request)
+			}
+		}))
+	t.Cleanup(service.server.Close)
+	return service
+}
+
+func (service *vaultService) lastShare(t *testing.T) map[string]any {
+	t.Helper()
+	service.mu.Lock()
+	defer service.mu.Unlock()
+	if len(service.published) != 1 {
+		t.Fatalf("published %d sessions, want 1", len(service.published))
+	}
+	share, _ := service.published[0]["owner_share"].(map[string]any)
+	return share
+}
+
+func testAccountKey(t *testing.T) string {
+	t.Helper()
+	private, err := ecdh.P256().GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("generate: %v", err)
+	}
+	return base64.RawURLEncoding.EncodeToString(private.PublicKey().Bytes())
+}
+
+func pinAccountKey(t *testing.T, path, key string) {
+	t.Helper()
+	credentials, err := account.Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	credentials.AccountKey = key
+	if err := account.Save(path, credentials); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+}
+
+func registerWithPassword(t *testing.T, password string) string {
+	t.Helper()
+	var warn bytes.Buffer
+	link := openSessionLink(context.Background(), &warn)
+	if link == nil {
+		t.Fatal("expected a link for a signed-in machine")
+	}
+	link.Register(context.Background(), sampleSessionInput(), password)
+	if strings.Contains(warn.String(), password) && password != "" {
+		t.Fatalf("the password was printed: %q", warn.String())
+	}
+	return warn.String()
+}
+
+func TestFirstVaultKeyIsPinnedAndUsed(t *testing.T) {
+	key := testAccountKey(t)
+	service := newVaultService(t, http.StatusOK, key)
+	path := linkedAccount(t, service.server.URL)
+
+	warn := registerWithPassword(t, vaultTestPassword)
+
+	share := service.lastShare(t)
+	if share == nil || !strings.HasPrefix(share["sealed"].(string), "v2.") {
+		t.Fatalf("owner_share = %+v, want a v2 envelope", share)
+	}
+	if strings.Contains(share["sealed"].(string), vaultTestPassword) {
+		t.Fatal("the password was sent in the clear")
+	}
+	stored, err := account.Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if stored.AccountKey != key {
+		t.Fatalf("pinned %q, want the key the service reported", stored.AccountKey)
+	}
+	fingerprint, _ := account.Fingerprint(key)
+	if !strings.Contains(warn, "saving session passwords to your vault (key "+fingerprint+")") {
+		t.Fatalf("output = %q, want the fingerprint announced once", warn)
+	}
+}
+
+func TestPinnedVaultKeyIsUsedSilently(t *testing.T) {
+	key := testAccountKey(t)
+	service := newVaultService(t, http.StatusOK, key)
+	pinAccountKey(t, linkedAccount(t, service.server.URL), key)
+
+	warn := registerWithPassword(t, vaultTestPassword)
+
+	if service.lastShare(t) == nil {
+		t.Fatal("no owner_share for a key that matches the pin")
+	}
+	if warn != "" {
+		t.Fatalf("a matching key should stay silent, got %q", warn)
+	}
+}
+
+// The service hands the key over. If it could swap it at will, it could read
+// every password sealed afterwards, so a changed key is refused.
+func TestChangedVaultKeyIsRefused(t *testing.T) {
+	service := newVaultService(t, http.StatusOK, testAccountKey(t))
+	path := linkedAccount(t, service.server.URL)
+	pinned := testAccountKey(t)
+	pinAccountKey(t, path, pinned)
+
+	warn := registerWithPassword(t, vaultTestPassword)
+
+	if share := service.lastShare(t); share != nil {
+		t.Fatalf("sealed to a key that does not match the pin: %+v", share)
+	}
+	if !strings.Contains(warn, "your vault key changed since this machine signed in") {
+		t.Fatalf("output = %q", warn)
+	}
+	stored, _ := account.Load(path)
+	if stored.AccountKey != pinned {
+		t.Fatal("the pin was replaced by the service's key")
+	}
+}
+
+func TestNoVaultMeansNoShareAndNoNoise(t *testing.T) {
+	service := newVaultService(t, http.StatusNotFound, "")
+	linkedAccount(t, service.server.URL)
+
+	warn := registerWithPassword(t, vaultTestPassword)
+
+	if share := service.lastShare(t); share != nil {
+		t.Fatalf("owner_share = %+v with no vault", share)
+	}
+	if warn != "" {
+		t.Fatalf("an account without a vault is normal; got %q", warn)
+	}
+}
+
+func TestVaultFailureStillPublishesTheSession(t *testing.T) {
+	service := newVaultService(t, http.StatusInternalServerError, "")
+	linkedAccount(t, service.server.URL)
+
+	warn := registerWithPassword(t, vaultTestPassword)
+
+	if share := service.lastShare(t); share != nil {
+		t.Fatalf("owner_share = %+v after a failed key request", share)
+	}
+	if !strings.Contains(warn, "this session's password was not saved to your vault") {
+		t.Fatalf("output = %q", warn)
+	}
+}
+
+func TestSessionWithoutAPasswordDoesNotAskForTheKey(t *testing.T) {
+	service := newVaultService(t, http.StatusOK, testAccountKey(t))
+	linkedAccount(t, service.server.URL)
+
+	registerWithPassword(t, "")
+
+	if service.keyAsks != 0 {
+		t.Fatalf("asked for the vault key %d times for a session with no password", service.keyAsks)
+	}
+	if share := service.lastShare(t); share != nil {
+		t.Fatalf("owner_share = %+v", share)
+	}
+}
+
+func TestSignInWithoutAUIDSkipsTheVault(t *testing.T) {
+	service := newVaultService(t, http.StatusOK, testAccountKey(t))
+	path := linkedAccount(t, service.server.URL)
+	credentials, _ := account.Load(path)
+	credentials.UID = ""
+	if err := account.Save(path, credentials); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+
+	warn := registerWithPassword(t, vaultTestPassword)
+
+	if share := service.lastShare(t); share != nil {
+		t.Fatalf("sealed without knowing whose vault it is: %+v", share)
+	}
+	if !strings.Contains(warn, "run 'shell login'") {
+		t.Fatalf("output = %q", warn)
+	}
+}
diff --git a/internal/account/client.go b/internal/account/client.go
index 95ba1a4..9d9ac28 100644
--- a/internal/account/client.go
+++ b/internal/account/client.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -49,6 +50,16 @@ type errorResponse struct {
 	Error string `json:"error"`
 }
 
+// statusError is a failing answer from the service. It keeps the status so a
+// caller can tell "there is nothing here" from "something went wrong"; its
+// message is exactly what callers have always seen.
+type statusError struct {
+	status  int
+	message string
+}
+
+func (failure *statusError) Error() string { return failure.message }
+
 // maxErrorBytes caps how much of a failing body is read into an error message.
 const maxErrorBytes = 4 << 10
 
@@ -92,14 +103,17 @@ func (client *Client) do(ctx context.Context, method, path, bearer string, body
 	if response.StatusCode < 200 || response.StatusCode > 299 {
 		var failure errorResponse
 		if json.Unmarshal(contents, &failure) == nil && failure.Error != "" {
-			return nil, fmt.Errorf("accounts service: %s", failure.Error)
+			return nil, &statusError{status: response.StatusCode, message: "accounts service: " + failure.Error}
 		}
 		snippet := contents
 		if len(snippet) > maxErrorBytes {
 			snippet = snippet[:maxErrorBytes]
 		}
-		return nil, fmt.Errorf("accounts service returned %d: %s",
-			response.StatusCode, strings.TrimSpace(string(snippet)))
+		return nil, &statusError{
+			status: response.StatusCode,
+			message: fmt.Sprintf("accounts service returned %d: %s",
+				response.StatusCode, strings.TrimSpace(string(snippet))),
+		}
 	}
 	return contents, nil
 }
@@ -192,6 +206,44 @@ type SessionInput struct {
 	Persistent bool   `json:"persistent"`
 	Host       string `json:"host"`
 	StartedAt  int64  `json:"started_at"`
+	// OwnerShare is the session password sealed to the account's vault key,
+	// so any of the person's browsers can open the session later. Absent when
+	// the session has no password or the account has no vault.
+	OwnerShare *KeyShare `json:"owner_share,omitempty"`
+}
+
+// KeyShare is a session password sealed to one account key. The accounts
+// service stores it and cannot open it.
+type KeyShare struct {
+	SenderPublicKey string `json:"sender_public_key"`
+	Sealed          string `json:"sealed"`
+}
+
+// AccountKey asks for the account's vault public key.
+//
+// ok is false, with no error, when the account has no vault yet: that is the
+// state of every account until its owner sets one up in the browser, and not
+// something to warn about. A key that does not parse is an error rather than
+// a missing vault, so a broken answer is not mistaken for an absent one.
+func (client *Client) AccountKey(ctx context.Context, accessToken string) (key string, ok bool, err error) {
+	contents, err := client.do(ctx, http.MethodGet, "/api/account/key", accessToken, nil)
+	var failure *statusError
+	if errors.As(err, &failure) && failure.status == http.StatusNotFound {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, err
+	}
+	var decoded struct {
+		PublicKey string `json:"public_key"`
+	}
+	if err := json.Unmarshal(contents, &decoded); err != nil {
+		return "", false, fmt.Errorf("decode account key: %w", err)
+	}
+	if err := ParseAccountKey(decoded.PublicKey); err != nil {
+		return "", false, fmt.Errorf("the accounts service returned an unusable key: %w", err)
+	}
+	return decoded.PublicKey, true, nil
 }
 
 // RegisterSession publishes a session so it appears in the account.
diff --git a/internal/account/credentials.go b/internal/account/credentials.go
index 351ac5a..4d0e3f4 100644
--- a/internal/account/credentials.go
+++ b/internal/account/credentials.go
@@ -26,6 +26,15 @@ type Credentials struct {
 	// not a decision worth holding someone to, so the next login asks again,
 	// while agreeing is never asked about twice.
 	RemoteStart bool `json:"remote_start,omitempty"`
+
+	// AccountKey is the account's vault public key, as this machine trusts it.
+	//
+	// It arrives from the signed-in browser on the login callback, which never
+	// passes through the accounts service, or failing that is pinned the first
+	// time the service reports one. After that a different key from the
+	// service is refused rather than believed: sealing a password to a key the
+	// service chose would let the service read it.
+	AccountKey string `json:"account_key,omitempty"`
 }
 
 // ErrNotLinked reports that no account has been linked on this machine.
diff --git a/internal/account/login.go b/internal/account/login.go
index 06761fa..1bf37bd 100644
--- a/internal/account/login.go
+++ b/internal/account/login.go
@@ -19,7 +19,10 @@ const LoginTimeout = 5 * time.Minute
 // callbackResult carries what the browser handed back on the loopback listener.
 type callbackResult struct {
 	code string
-	err  error
+	// accountKey is the vault public key the browser vouched for, or empty
+	// when it sent none or sent something that is not a key.
+	accountKey string
+	err        error
 }
 
 // callbackPage is what the person sees after approving, in the browser tab the
@@ -123,7 +126,17 @@ func newCallbackHandler(state, webURL string, results chan<- callbackResult) htt
 			return
 		}
 
-		deliver(callbackResult{code: code})
+		// Read only once the state has matched, so it comes from the browser
+		// this login opened. It travels browser to loopback directly, which is
+		// why it is trusted over whatever the accounts service says later. A
+		// malformed value is dropped rather than failing the login: the key is
+		// an addition to signing in, not a condition of it.
+		accountKey := query.Get("account_key")
+		if ParseAccountKey(accountKey) != nil {
+			accountKey = ""
+		}
+
+		deliver(callbackResult{code: code, accountKey: accountKey})
 		if onwards != "" {
 			// 303, because the browser should follow this with a GET and not
 			// re-send anything from the request that got it here.
@@ -231,7 +244,12 @@ func Login(ctx context.Context, client *Client, options Options) (Credentials, e
 		if label == "" {
 			label = defaultLabel()
 		}
-		return client.Exchange(ctx, result.code, verifier, redirectURI, label, options.MachineID)
+		credentials, err := client.Exchange(ctx, result.code, verifier, redirectURI, label, options.MachineID)
+		if err != nil {
+			return Credentials{}, err
+		}
+		credentials.AccountKey = result.accountKey
+		return credentials, nil
 	case <-waitContext.Done():
 		if errors.Is(waitContext.Err(), context.DeadlineExceeded) {
 			return Credentials{}, fmt.Errorf("timed out after %s waiting for the browser", timeout)
diff --git a/internal/account/testdata/vault-share-v2-browser.json b/internal/account/testdata/vault-share-v2-browser.json
new file mode 100644
index 0000000..b60c43b
--- /dev/null
+++ b/internal/account/testdata/vault-share-v2-browser.json
@@ -0,0 +1,9 @@
+{
+  "recipient_private_key_hex": "8b434a305a04bf2e54de3c66aa69cd39aea84a6b69c01bd8cedf6fc5148ba94c",
+  "recipient_public_key": "BBtGQCwqwBUH69JfdTY7YLUVEp9Ya6Cx7vTUmkr5p6MCowr_BKtP3H_vVacze6qj3IhF_ggCteJqtmpFcoOgGKY",
+  "session_id": "Vb3xTm9Ld2RqN7wKavh4YsPcE8UjZgF6",
+  "uid": "uid-browser",
+  "password": "t9QmZ2vXk4LrP8sWc1Nb3A",
+  "sender_public_key": "BDxrse1_E7EAHDreFfDYFkHs7kcn3d2n_BqKorrlu6H-9FarvjSDUCUSY3EOYKRBJusTV2E2GwRZLdplZc3UbQY",
+  "sealed": "v2.0mhlCmb_jlmlzkl_w7-05CaLbx6gee9_yqin1Q-kpk5ajPrqmhImctabXk6A1A9s_Ts"
+}
diff --git a/internal/account/testdata/vault-share-v2-go.json b/internal/account/testdata/vault-share-v2-go.json
new file mode 100644
index 0000000..0b69fb1
--- /dev/null
+++ b/internal/account/testdata/vault-share-v2-go.json
@@ -0,0 +1,9 @@
+{
+  "recipient_private_key_hex": "1e395c47c72458f35b7540c47e2afacefbf0bc3b80ed6957aca1e004e8b35a9a",
+  "recipient_public_key": "BNZ6xhNEUxRDRRaBHa4iAlfrLu2fVGhk3mgx-XiVt7Owr4o_BN2axcRLKFLf9eXLtwJ9vEBQgiBArM7fIggxvXA",
+  "session_id": "qN7wKb3xTm9Ld2Ravh4YsPcE8UjZgF6t",
+  "uid": "uid-vector",
+  "password": "Kw9eHbru",
+  "sender_public_key": "BM4rJdocNKu-sk24tVjh1QKxfdLJN43q2NVO3NElj_H09ORvqFD6ZcX7xJ_DTef8pYUGo0AJz9bnFV8oxvkBElc",
+  "sealed": "v2.AAECAwQFBgcICQoLu1eCNMH4llbSSuHT4tJhJ5i2IkW1aTNL"
+}
diff --git a/internal/account/vault.go b/internal/account/vault.go
new file mode 100644
index 0000000..48c8d44
--- /dev/null
+++ b/internal/account/vault.go
@@ -0,0 +1,164 @@
+package account
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/ecdh"
+	"crypto/hkdf"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// A session's password is chosen on the machine that runs it, and until now it
+// lived only there and in whichever browser happened to be told it. Close the
+// terminal window, clear the browser, and the session could never be opened
+// again.
+//
+// So the CLI now seals every password to the account's own public key when it
+// publishes the session. The private half never leaves the person's browsers
+// unencrypted: the accounts service keeps it wrapped under a recovery key it
+// has never seen. The service stores this envelope and cannot open it, which
+// is the same promise the agent envelope in sealed.go makes, extended from one
+// agent run to the account.
+//
+// The session id and the recipient's uid are bound in as associated data. The
+// service decides which envelope goes with which session, and without the
+// binding it could hand one session's password to another session's pane.
+
+// vaultShareInfo separates this derivation from every other use of the curve.
+// It differs from sealInfo on purpose: the two envelopes carry the same kind of
+// secret to different keys, and must never be mistaken for each other.
+const vaultShareInfo = "shell.online session vault v2"
+
+// vaultSharePrefix versions the envelope in the value itself, so a later format
+// can be told apart without a schema change on the service.
+const vaultSharePrefix = "v2."
+
+// accountKeyBytes is an uncompressed P-256 point.
+const accountKeyBytes = 65
+
+// ParseAccountKey reports whether value is an account public key: base64url
+// without padding, decoding to an uncompressed P-256 point.
+func ParseAccountKey(value string) error {
+	_, err := decodeAccountKey(value)
+	return err
+}
+
+func decodeAccountKey(value string) (*ecdh.PublicKey, error) {
+	raw, err := base64.RawURLEncoding.DecodeString(value)
+	if err != nil {
+		return nil, fmt.Errorf("account key is not base64url: %w", err)
+	}
+	if len(raw) != accountKeyBytes {
+		return nil, fmt.Errorf("account key is %d bytes, want %d", len(raw), accountKeyBytes)
+	}
+	key, err := ecdh.P256().NewPublicKey(raw)
+	if err != nil {
+		return nil, fmt.Errorf("account key is not a P-256 point: %w", err)
+	}
+	return key, nil
+}
+
+// Fingerprint is the short form of an account key that a person compares by
+// eye: the first eight bytes of its SHA-256, as four groups of four hex digits.
+// The web app's account page shows the same value.
+func Fingerprint(accountPublicKey string) (string, error) {
+	key, err := decodeAccountKey(accountPublicKey)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(key.Bytes())
+	digits := hex.EncodeToString(sum[:8])
+	return digits[0:4] + "-" + digits[4:8] + "-" + digits[8:12] + "-" + digits[12:16], nil
+}
+
+// SealToAccount seals a session password so that only the holder of the
+// account's private key can read it, and only as the password of this session
+// for this person.
+func SealToAccount(accountPublicKey, sessionID, recipientUID, password string) (senderPublicKey, sealed string, err error) {
+	ephemeral, err := ecdh.P256().GenerateKey(rand.Reader)
+	if err != nil {
+		return "", "", fmt.Errorf("generate ephemeral key: %w", err)
+	}
+	nonce := make([]byte, sealNonceBytes)
+	if _, err := rand.Read(nonce); err != nil {
+		return "", "", fmt.Errorf("generate nonce: %w", err)
+	}
+	return sealToAccountWith(ephemeral, nonce, accountPublicKey, sessionID, recipientUID, password)
+}
+
+// sealToAccountWith is SealToAccount with the randomness supplied, so a test
+// can produce a fixed vector for the browser to check against.
+func sealToAccountWith(
+	ephemeral *ecdh.PrivateKey, nonce []byte, accountPublicKey, sessionID, recipientUID, password string,
+) (string, string, error) {
+	if sessionID == "" || recipientUID == "" {
+		return "", "", errors.New("a vault share needs a session id and a recipient")
+	}
+	recipient, err := decodeAccountKey(accountPublicKey)
+	if err != nil {
+		return "", "", err
+	}
+	aead, err := vaultShareCipher(ephemeral, recipient)
+	if err != nil {
+		return "", "", err
+	}
+	ciphertext := aead.Seal(nil, nonce, []byte(password), vaultShareAAD(sessionID, recipientUID))
+	envelope := append(append([]byte{}, nonce...), ciphertext...)
+	return base64.RawURLEncoding.EncodeToString(ephemeral.PublicKey().Bytes()),
+		vaultSharePrefix + base64.RawURLEncoding.EncodeToString(envelope),
+		nil
+}
+
+// openFromAccount is the browser's half, kept here so the Go tests check the
+// envelope end to end. The CLI itself never holds an account private key.
+func openFromAccount(private *ecdh.PrivateKey, sessionID, recipientUID, senderPublicKey, sealed string) (string, error) {
+	if !strings.HasPrefix(sealed, vaultSharePrefix) {
+		return "", errors.New("not a v2 vault share")
+	}
+	sender, err := decodeAccountKey(senderPublicKey)
+	if err != nil {
+		return "", fmt.Errorf("sender key: %w", err)
+	}
+	envelope, err := base64.RawURLEncoding.DecodeString(strings.TrimPrefix(sealed, vaultSharePrefix))
+	if err != nil {
+		return "", fmt.Errorf("vault share is not base64url: %w", err)
+	}
+	if len(envelope) <= sealNonceBytes {
+		return "", errors.New("vault share is too short")
+	}
+	aead, err := vaultShareCipher(private, sender)
+	if err != nil {
+		return "", err
+	}
+	plaintext, err := aead.Open(nil, envelope[:sealNonceBytes], envelope[sealNonceBytes:], vaultShareAAD(sessionID, recipientUID))
+	if err != nil {
+		return "", errors.New("the vault share could not be opened")
+	}
+	return string(plaintext), nil
+}
+
+func vaultShareAAD(sessionID, recipientUID string) []byte {
+	return []byte(sessionID + "\x00" + recipientUID)
+}
+
+func vaultShareCipher(private *ecdh.PrivateKey, public *ecdh.PublicKey) (cipher.AEAD, error) {
+	shared, err := private.ECDH(public)
+	if err != nil {
+		return nil, fmt.Errorf("derive shared secret: %w", err)
+	}
+	derived, err := hkdf.Key(sha256.New, shared, nil, vaultShareInfo, 32)
+	if err != nil {
+		return nil, fmt.Errorf("derive key: %w", err)
+	}
+	block, err := aes.NewCipher(derived)
+	if err != nil {
+		return nil, fmt.Errorf("build cipher: %w", err)
+	}
+	return cipher.NewGCM(block)
+}
diff --git a/internal/account/vault_client_test.go b/internal/account/vault_client_test.go
new file mode 100644
index 0000000..1d533e0
--- /dev/null
+++ b/internal/account/vault_client_test.go
@@ -0,0 +1,207 @@
+package account
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestCallbackHandlerCarriesTheAccountKey(t *testing.T) {
+	_, public := newAccountKey(t)
+	results := make(chan callbackResult, 1)
+	handler := newCallbackHandler("state-123", "", results)
+
+	handler.ServeHTTP(httptest.NewRecorder(),
+		callbackRequest("code=shc_abc&state=state-123&account_key="+public))
+
+	result := <-results
+	if result.err != nil || result.code != "shc_abc" {
+		t.Fatalf("result = %+v", result)
+	}
+	if result.accountKey != public {
+		t.Fatalf("accountKey = %q, want the key the browser sent", result.accountKey)
+	}
+}
+
+// A malformed key must not stop someone signing in: it is simply not trusted.
+func TestCallbackHandlerDropsAMalformedAccountKey(t *testing.T) {
+	results := make(chan callbackResult, 1)
+	handler := newCallbackHandler("state-123", "", results)
+
+	handler.ServeHTTP(httptest.NewRecorder(),
+		callbackRequest("code=shc_abc&state=state-123&account_key=not-a-key"))
+
+	result := <-results
+	if result.err != nil || result.code != "shc_abc" {
+		t.Fatalf("result = %+v", result)
+	}
+	if result.accountKey != "" {
+		t.Fatalf("accountKey = %q, want nothing trusted", result.accountKey)
+	}
+}
+
+func TestCallbackHandlerTrustsNoKeyWhenTheStateIsWrong(t *testing.T) {
+	_, public := newAccountKey(t)
+	results := make(chan callbackResult, 1)
+	handler := newCallbackHandler("state-123", "", results)
+
+	handler.ServeHTTP(httptest.NewRecorder(),
+		callbackRequest("code=shc_abc&state=forged&account_key="+public))
+
+	result := <-results
+	if result.err == nil {
+		t.Fatal("a forged callback was accepted")
+	}
+	if result.accountKey != "" {
+		t.Fatal("a forged callback got its key trusted")
+	}
+}
+
+// End to end: the key the browser puts on the callback is the key the
+// credentials carry away.
+func TestLoginPinsTheAccountKeyFromTheBrowser(t *testing.T) {
+	_, public := newAccountKey(t)
+	service := httptest.NewServer(http.HandlerFunc(
+		func(writer http.ResponseWriter, request *http.Request) {
+			writeJSON(writer, http.StatusOK, map[string]any{
+				"access_token":  "sha_access",
+				"refresh_token": "shr_refresh",
+				"expires_in":    3600,
+				"account":       map[string]string{"uid": "uid-1", "email": "ana@example.com"},
+			})
+		}))
+	defer service.Close()
+
+	browser := func(authorize string) error {
+		parsed, err := url.Parse(authorize)
+		if err != nil {
+			return err
+		}
+		query := parsed.Query()
+		callback := fmt.Sprintf("%s?code=shc_abc&state=%s&account_key=%s",
+			query.Get("redirect_uri"), url.QueryEscape(query.Get("state")), public)
+		go func() {
+			response, err := http.Get(callback)
+			if err == nil {
+				response.Body.Close()
+			}
+		}()
+		return nil
+	}
+
+	credentials, err := Login(context.Background(), NewClient(service.URL, "test"), Options{
+		WebURL:      "https://app.shell.online",
+		OpenBrowser: browser,
+		Timeout:     10 * time.Second,
+	})
+	if err != nil {
+		t.Fatalf("Login: %v", err)
+	}
+	if credentials.AccountKey != public {
+		t.Fatalf("AccountKey = %q, want the key from the callback", credentials.AccountKey)
+	}
+	if credentials.UID != "uid-1" {
+		t.Fatalf("UID = %q", credentials.UID)
+	}
+}
+
+func TestAccountKey(t *testing.T) {
+	_, public := newAccountKey(t)
+	tests := []struct {
+		name    string
+		status  int
+		body    any
+		wantKey string
+		wantOK  bool
+		wantErr string
+	}{
+		{"a vault", http.StatusOK, map[string]any{"public_key": public, "version": 1}, public, true, ""},
+		{"no vault yet", http.StatusNotFound, map[string]string{"error": "no vault"}, "", false, ""},
+		{"a failure", http.StatusInternalServerError, map[string]string{"error": "database down"}, "", false, "database down"},
+		{"a key that is not one", http.StatusOK, map[string]any{"public_key": "junk"}, "", false, "unusable key"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			var authorization, path string
+			service := httptest.NewServer(http.HandlerFunc(
+				func(writer http.ResponseWriter, request *http.Request) {
+					authorization = request.Header.Get("Authorization")
+					path = request.URL.Path
+					writeJSON(writer, test.status, test.body)
+				}))
+			defer service.Close()
+
+			key, ok, err := NewClient(service.URL, "test").AccountKey(context.Background(), "sha_token")
+			if path != "/api/account/key" || authorization != "Bearer sha_token" {
+				t.Fatalf("asked %q with %q", path, authorization)
+			}
+			if test.wantErr == "" && err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if test.wantErr != "" && (err == nil || !strings.Contains(err.Error(), test.wantErr)) {
+				t.Fatalf("err = %v, want one mentioning %q", err, test.wantErr)
+			}
+			if key != test.wantKey || ok != test.wantOK {
+				t.Fatalf("AccountKey = %q, %v; want %q, %v", key, ok, test.wantKey, test.wantOK)
+			}
+		})
+	}
+}
+
+// Existing callers match on these messages, so wrapping the status in a type
+// must not have changed a word of them.
+func TestFailingResponsesKeepTheirMessages(t *testing.T) {
+	service := httptest.NewServer(http.HandlerFunc(
+		func(writer http.ResponseWriter, request *http.Request) {
+			if request.URL.Path == "/json" {
+				writeJSON(writer, http.StatusBadRequest, map[string]string{"error": "bad thing"})
+				return
+			}
+			writer.WriteHeader(http.StatusBadGateway)
+			_, _ = writer.Write([]byte("  upstream  "))
+		}))
+	defer service.Close()
+	client := NewClient(service.URL, "test")
+
+	if _, err := client.do(context.Background(), http.MethodGet, "/json", "", nil); err == nil ||
+		err.Error() != "accounts service: bad thing" {
+		t.Fatalf("err = %v", err)
+	}
+	if _, err := client.do(context.Background(), http.MethodGet, "/plain", "", nil); err == nil ||
+		err.Error() != "accounts service returned 502: upstream" {
+		t.Fatalf("err = %v", err)
+	}
+}
+
+func TestRegisterSessionSendsTheOwnerShare(t *testing.T) {
+	var body map[string]any
+	service := httptest.NewServer(http.HandlerFunc(
+		func(writer http.ResponseWriter, request *http.Request) {
+			decodeJSON(t, request, &body)
+			writeJSON(writer, http.StatusCreated, map[string]any{})
+		}))
+	defer service.Close()
+	client := NewClient(service.URL, "test")
+
+	input := SessionInput{ID: testSessionID, ShareURL: "https://shell.online/s/x", Command: "claude"}
+	if err := client.RegisterSession(context.Background(), "sha", input); err != nil {
+		t.Fatalf("RegisterSession: %v", err)
+	}
+	if _, present := body["owner_share"]; present {
+		t.Fatalf("a session without a share sent one: %+v", body)
+	}
+
+	input.OwnerShare = &KeyShare{SenderPublicKey: "sender", Sealed: "v2.sealed"}
+	if err := client.RegisterSession(context.Background(), "sha", input); err != nil {
+		t.Fatalf("RegisterSession: %v", err)
+	}
+	share, ok := body["owner_share"].(map[string]any)
+	if !ok || share["sender_public_key"] != "sender" || share["sealed"] != "v2.sealed" {
+		t.Fatalf("owner_share = %+v", body["owner_share"])
+	}
+}
diff --git a/internal/account/vault_test.go b/internal/account/vault_test.go
new file mode 100644
index 0000000..db0d583
--- /dev/null
+++ b/internal/account/vault_test.go
@@ -0,0 +1,290 @@
+package account
+
+import (
+	"bytes"
+	"crypto/ecdh"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+const (
+	testSessionID = "qN7wKb3xTm9Ld2Ravh4YsPcE8UjZgF6t"
+	testUID       = "uid-1"
+)
+
+func newAccountKey(t *testing.T) (*ecdh.PrivateKey, string) {
+	t.Helper()
+	private, err := ecdh.P256().GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("generate: %v", err)
+	}
+	return private, base64.RawURLEncoding.EncodeToString(private.PublicKey().Bytes())
+}
+
+func TestVaultShareRoundTrips(t *testing.T) {
+	private, public := newAccountKey(t)
+	sender, sealed, err := SealToAccount(public, testSessionID, testUID, "Kw9eHbru")
+	if err != nil {
+		t.Fatalf("SealToAccount: %v", err)
+	}
+	if !strings.HasPrefix(sealed, "v2.") {
+		t.Fatalf("sealed = %q, want the v2. prefix", sealed)
+	}
+	got, err := openFromAccount(private, testSessionID, testUID, sender, sealed)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	if got != "Kw9eHbru" {
+		t.Fatalf("open = %q", got)
+	}
+}
+
+func TestVaultShareHidesThePassword(t *testing.T) {
+	_, public := newAccountKey(t)
+	_, sealed, err := SealToAccount(public, testSessionID, testUID, "Kw9eHbru")
+	if err != nil {
+		t.Fatalf("SealToAccount: %v", err)
+	}
+	raw, err := base64.RawURLEncoding.DecodeString(strings.TrimPrefix(sealed, "v2."))
+	if err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if bytes.Contains(raw, []byte("Kw9eHbru")) {
+		t.Fatal("the password appears in the envelope in the clear")
+	}
+}
+
+// The service chooses which envelope goes with which session. Each of these is
+// a way it could try to misuse one, and each must fail to open.
+func TestVaultShareRefusesToOpenOutOfPlace(t *testing.T) {
+	private, public := newAccountKey(t)
+	sender, sealed, err := SealToAccount(public, testSessionID, testUID, "Kw9eHbru")
+	if err != nil {
+		t.Fatalf("SealToAccount: %v", err)
+	}
+	other, _ := newAccountKey(t)
+
+	raw, _ := base64.RawURLEncoding.DecodeString(strings.TrimPrefix(sealed, "v2."))
+	raw[len(raw)-1] ^= 0x01
+	tampered := "v2." + base64.RawURLEncoding.EncodeToString(raw)
+
+	tests := []struct {
+		name      string
+		private   *ecdh.PrivateKey
+		sessionID string
+		uid       string
+		sender    string
+		sealed    string
+	}{
+		{"another session", private, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", testUID, sender, sealed},
+		{"another person", private, testSessionID, "uid-2", sender, sealed},
+		{"another account key", other, testSessionID, testUID, sender, sealed},
+		{"a flipped ciphertext bit", private, testSessionID, testUID, sender, tampered},
+		{"no version prefix", private, testSessionID, testUID, sender, strings.TrimPrefix(sealed, "v2.")},
+		{"an agent-style envelope", private, testSessionID, testUID, sender, "v1." + strings.TrimPrefix(sealed, "v2.")},
+		{"a sender that is not a key", private, testSessionID, testUID, "junk", sealed},
+		{"an envelope that is only a nonce", private, testSessionID, testUID, sender,
+			"v2." + base64.RawURLEncoding.EncodeToString(make([]byte, 12))},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if _, err := openFromAccount(test.private, test.sessionID, test.uid, test.sender, test.sealed); err == nil {
+				t.Fatal("opened an envelope that should have been refused")
+			}
+		})
+	}
+}
+
+func TestSealToAccountRejectsBadInput(t *testing.T) {
+	_, public := newAccountKey(t)
+	tests := []struct {
+		name, key, sessionID, uid string
+	}{
+		{"key is not base64url", "not base64!", testSessionID, testUID},
+		{"key is not a point", base64.RawURLEncoding.EncodeToString(make([]byte, 65)), testSessionID, testUID},
+		{"no session id", public, "", testUID},
+		{"no recipient", public, testSessionID, ""},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if _, _, err := SealToAccount(test.key, test.sessionID, test.uid, "pw"); err == nil {
+				t.Fatal("SealToAccount accepted bad input")
+			}
+		})
+	}
+}
+
+func TestParseAccountKey(t *testing.T) {
+	_, public := newAccountKey(t)
+	private, _ := newAccountKey(t)
+	compressed := base64.RawURLEncoding.EncodeToString(private.PublicKey().Bytes()[:33])
+
+	if err := ParseAccountKey(public); err != nil {
+		t.Fatalf("a real key was refused: %v", err)
+	}
+	for name, value := range map[string]string{
+		"empty":             "",
+		"not base64url":     "abc$def",
+		"padded base64":     public + "=",
+		"too short":         compressed,
+		"all zero point":    base64.RawURLEncoding.EncodeToString(make([]byte, 65)),
+		"random 65 bytes":   base64.RawURLEncoding.EncodeToString(bytes.Repeat([]byte{0x04, 0x11}, 33)[:65]),
+		"standard alphabet": strings.NewReplacer("-", "+", "_", "/").Replace(public) + "+/",
+	} {
+		t.Run(name, func(t *testing.T) {
+			if err := ParseAccountKey(value); err == nil {
+				t.Fatalf("ParseAccountKey accepted %q", value)
+			}
+		})
+	}
+}
+
+func TestFingerprintIsShortAndStable(t *testing.T) {
+	_, public := newAccountKey(t)
+	first, err := Fingerprint(public)
+	if err != nil {
+		t.Fatalf("Fingerprint: %v", err)
+	}
+	if !regexp.MustCompile(`^[0-9a-f]{4}(-[0-9a-f]{4}){3}$`).MatchString(first) {
+		t.Fatalf("fingerprint = %q, want four groups of four hex digits", first)
+	}
+	raw, _ := base64.RawURLEncoding.DecodeString(public)
+	sum := sha256.Sum256(raw)
+	if strings.ReplaceAll(first, "-", "") != hex.EncodeToString(sum[:8]) {
+		t.Fatalf("fingerprint %q is not the first eight bytes of the key's SHA-256", first)
+	}
+	if _, err := Fingerprint("junk"); err == nil {
+		t.Fatal("Fingerprint accepted something that is not a key")
+	}
+}
+
+/*
+ * The cross-language vectors.
+ *
+ * The browser opens what the CLI seals and seals what the web app stores, so
+ * the two implementations must agree byte for byte on the derivation. Each side
+ * writes a fixed vector the other opens in its own tests.
+ */
+
+type vaultVector struct {
+	RecipientPrivateKeyHex string `json:"recipient_private_key_hex"`
+	RecipientPublicKey     string `json:"recipient_public_key"`
+	SessionID              string `json:"session_id"`
+	UID                    string `json:"uid"`
+	Password               string `json:"password"`
+	SenderPublicKey        string `json:"sender_public_key"`
+	Sealed                 string `json:"sealed"`
+}
+
+const goVectorPath = "testdata/vault-share-v2-go.json"
+const browserVectorPath = "testdata/vault-share-v2-browser.json"
+
+func fixedScalar(t *testing.T, label string) *ecdh.PrivateKey {
+	t.Helper()
+	sum := sha256.Sum256([]byte(label))
+	key, err := ecdh.P256().NewPrivateKey(sum[:])
+	if err != nil {
+		t.Fatalf("fixed key %q: %v", label, err)
+	}
+	return key
+}
+
+func buildGoVector(t *testing.T) vaultVector {
+	t.Helper()
+	recipient := fixedScalar(t, "shell.online vault vector recipient")
+	ephemeral := fixedScalar(t, "shell.online vault vector ephemeral")
+	nonce := []byte{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}
+	public := base64.RawURLEncoding.EncodeToString(recipient.PublicKey().Bytes())
+	vector := vaultVector{
+		RecipientPrivateKeyHex: hex.EncodeToString(recipient.Bytes()),
+		RecipientPublicKey:     public,
+		SessionID:              testSessionID,
+		UID:                    "uid-vector",
+		Password:               "Kw9eHbru",
+	}
+	sender, sealed, err := sealToAccountWith(ephemeral, nonce, public, vector.SessionID, vector.UID, vector.Password)
+	if err != nil {
+		t.Fatalf("seal: %v", err)
+	}
+	vector.SenderPublicKey = sender
+	vector.Sealed = sealed
+	return vector
+}
+
+func openVector(t *testing.T, vector vaultVector) string {
+	t.Helper()
+	scalar, err := hex.DecodeString(vector.RecipientPrivateKeyHex)
+	if err != nil {
+		t.Fatalf("private key hex: %v", err)
+	}
+	private, err := ecdh.P256().NewPrivateKey(scalar)
+	if err != nil {
+		t.Fatalf("private key: %v", err)
+	}
+	if got := base64.RawURLEncoding.EncodeToString(private.PublicKey().Bytes()); got != vector.RecipientPublicKey {
+		t.Fatalf("the vector's public key does not belong to its private key")
+	}
+	password, err := openFromAccount(private, vector.SessionID, vector.UID, vector.SenderPublicKey, vector.Sealed)
+	if err != nil {
+		t.Fatalf("open vector: %v", err)
+	}
+	return password
+}
+
+// The file is what the browser test reads, so it must be exactly what this
+// code produces. Regenerate with UPDATE_VAULT_VECTOR=1 after a deliberate
+// change to the format, never by hand.
+func TestGoVaultVectorMatchesTestdata(t *testing.T) {
+	vector := buildGoVector(t)
+	encoded, err := json.MarshalIndent(vector, "", "  ")
+	if err != nil {
+		t.Fatalf("encode: %v", err)
+	}
+	encoded = append(encoded, '\n')
+
+	if os.Getenv("UPDATE_VAULT_VECTOR") == "1" {
+		if err := os.MkdirAll(filepath.Dir(goVectorPath), 0o755); err != nil {
+			t.Fatalf("mkdir: %v", err)
+		}
+		if err := os.WriteFile(goVectorPath, encoded, 0o644); err != nil {
+			t.Fatalf("write: %v", err)
+		}
+	}
+
+	stored, err := os.ReadFile(goVectorPath)
+	if err != nil {
+		t.Fatalf("read %s: %v", goVectorPath, err)
+	}
+	if !bytes.Equal(stored, encoded) {
+		t.Fatalf("%s no longer matches what this code seals; the browser test is checking a stale vector", goVectorPath)
+	}
+	if got := openVector(t, vector); got != vector.Password {
+		t.Fatalf("vector opened to %q", got)
+	}
+}
+
+func TestOpenBrowserVaultVector(t *testing.T) {
+	contents, err := os.ReadFile(browserVectorPath)
+	if errors.Is(err, os.ErrNotExist) {
+		t.Skipf("%s has not been generated by the web app yet", browserVectorPath)
+	}
+	if err != nil {
+		t.Fatalf("read: %v", err)
+	}
+	var vector vaultVector
+	if err := json.Unmarshal(contents, &vector); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if got := openVector(t, vector); got != vector.Password {
+		t.Fatalf("the browser's envelope opened to %q, want %q", got, vector.Password)
+	}
+}