Cloaked Vault
The Cloaked Vault is a separate environment running locally in your browser. Both the Cloaked web app and browser extension use it for sign-in and sensitive wallet actions, keeping your credentials and spending keys isolated from the everyday app interface.
Cloaked is non-custodial. You control your funds. Your spending keys are derived and used locally on your device and are never sent to Cloaked's servers.
How the vault works
Your browser enforces separation between the vault and the surrounding app. Code running in the main app cannot directly read the vault's contents or access the secrets it holds. Your PIN, passkey-derived secrets, and spending keys are not passed back to the main app.
The main app can display your account, balances, and activity without receiving your spending keys.
The vault also handles transaction review and approval. You review the request and authorize it within the same environment that performs the signing. Before signing, Cloaked checks that the request still matches what you reviewed.
The vault works alongside Clear Signing, which helps you understand supported requests before you approve them.
This separation reduces how much of the application handles sensitive information and limits its exposure if malicious code runs in the main app.
How the vault is built
The vault is built and deployed on its own, separately from the app.
- One self-contained document. The vault ships as a single file with its code included, so nothing extra is fetched while it loads.
- Code pinned by fingerprint. The vault is delivered with a policy that names the exact code the browser may run. Injected or dynamically loaded scripts are refused.
- Fixed releases. Each release is numbered, archived, and never replaced, so an earlier version keeps working and a withdrawn one stops before it handles anything sensitive.
- A short list of dependencies and connections. Dependencies are pinned to exact versions, and the vault may only reach a small, explicit set of services.
When you'll use the vault
There's nothing to enable or set up. Cloaked automatically uses the vault for sign-in, transaction and message approvals, and sensitive account tools such as creating backups or viewing your keys. Whenever Cloaked asks you to sign, the vault handles the review and signing process. You still review and approve the request.
The vault is loaded from auth.clkd.xyz/vault.html and runs locally in your browser. It usually appears inside the app or extension through an iframe, a separate web page embedded within the interface. Some browsers and wallet connections open it in a separate window instead. Both use the same vault.
What you need to know
You can continue using your existing account, passkey, or wallet and PIN. The vault does not change your wallet keys or move your funds.
The vault adds a layer of protection, but security still depends on the vault's code, your browser, and your device. Misleading requests and phishing remain possible, so always check what you are approving.