Unlatch
Overview
This page documents public product behavior for Unlatch, including account flow, login, logout, vault creation, and vault unlock behavior visible from frontend features. The vault creation flow currently creates a vault immediately without a vault email code step.
Core Security
AES-256 style encrypted vault workflow, cookie-based sessions, and optional biometric unlock.
Scope
Docs include login, logout, vault creation, lock and unlock behavior, shared item workflows, and how recipients access received items.
Login and Logout
1. Registration with Email Verification
New users register, then verify using a 4-digit email code to complete account verification.
2. Login
Login validates credentials and sets access plus refresh cookies. Session profile is loaded after sign-in and unlock access to user pages.
3. Account Recovery
Forgot password issues a time-limited token. Reset password updates the account when token is valid.
How to Login
- Open the Log In page.
- Enter your email and password.
- Submit and continue to your dashboard.
How to Logout
- Open the profile menu from top-right.
- Click Sign Out.
- Session cookies are cleared and you return safely.
Vault Setup and Lock
Vault requires name plus password and is created instantly. No vault 2FA verification step is required.
Rule: one vault per account.
Unlock with vault password to receive vault session cookie. Vault items APIs require unlocked vault session.
Lockout: 3 failed attempts trigger temporary lock for about 1 hour.
Users with registered biometric credentials can unlock through WebAuthn challenge and verification endpoints.
How to Create a Vault
- Login to your account.
- Click Create Vault from the navbar button.
- Enter vault name and vault password.
- Submit to create vault immediately.
- Unlock your vault with password or biometrics.
How Lock and Unlock Works
- After login, open My Vault if you already created one.
- If the vault is locked, the app redirects you to the unlock screen.
- Enter your vault password to open the vault session.
- Vault items and shared items load only after the vault session is valid.
- Signing out clears the account session and ends vault access.
Screenshots and UI References



