Keyra *during the first run gathers the random entropy.  Keyra will use this value to make all secrets hard to guess by an attacker.

* only when no hardware Random Number Generators are present

Keyra uses both how you type (your unique typing rhythm and patterns) and what you type to gather initial entropy. Your typing behavior provides a behavioral biometric signature, helping Keyra generate randomness for secure cryptographic keys creation.

Keyra will now create your first vault, called "My Secrets".

Keyra will now create your first vault designed for sharing, called "Team One."

You don't have to share this vault. Its purpose is to help you distinguish between personal and shared information, ensuring that your private "My Secrets" vault always remains personal and is never shared.

On Windows, Keyra uses Windows authentication integrated with Active Directory by default.

Provide a name and any additional unprotected properties to create a new secret in the selected vault.

Only the following fields are encrypted:

- Password

- Secret Properties (Encrypted)

- Secret Files (Encrypted)

All other properties are stored without encryption.

Secrets created by dragging and dropping files automatically store the files in the "Secret Files (Encrypted)" section.

File metadata is preserved as unprotected "Additional Properties", while the file contents remain encrypted.

Hold Shift and right-click the "Team One" vault to reveal additional options specific to vaults.

Shift + Right-click always reveals advanced options based on the type of object you select, such as a vault or a secret.

Select "Share Vault" to start your first collaboration.

Keyra lets you choose the authenticators that form your authentication chain.

Available authenticators are automatically detected based on your platform and connected hardware (e.g., YubiKey configured for Challenge-Response).

For cross-platform sharing, ensure that your selected authenticators are supported on all platforms where the vault will be imported.

The selected authenticators can be changed after importing the vault.

Add or remove Windows security principals, either local accounts and groups or those managed through Active Directory.

By default, users must satisfy all listed Windows principals to import the vault.

If satisfying any one of the listed principals should be sufficient, change "Access Logic" from "All (AND)" to "Any (OR)".

To further restrict access with "All (AND)" or extend access with "Any (OR)", click "Add..." to select additional Windows security principals using the Windows Security Principal Picker.

By selecting an Active Directory (AD) group, you can allow any member of that group to import the vault (e.g., AG-Keyra-TeamTwo group).

Once the "Team One" vault has been successfully prepared for sharing, its armored data is automatically copied to your clipboard, ready to be shared with your team through your preferred communication channel.

For mobile devices, you can alternatively use the animated QR code to import the vault.

Note: Mobile devices do not support Windows authenticators. Ensure the vault uses authenticators supported by the target device.

The "Team One" vault's armored text is now available on your clipboard.

Simply paste it into your preferred messaging app or email client and send it to the team members you want to collaborate with.

Recipients can then import the vault using their supported authenticators and the configured access permissions.

If YubiKeys were selected as authenticators in the authentication chain, you must also physically share the corresponding YubiKeys with the recipients.

To import the shared vault, copy the entire ASCII-armored text from the received message, starting with "KEYRA:...".

Paste the copied text into Keyra to begin importing the Team One vault.

Each imported vault must have a unique name.

Keep the original Team One name or choose a different one if a vault with that name already exists.

Hold Shift and right-click the secret you want to share, then select "Copy Secret".

Keyra will generate an *ASCII-armored version of the secret, ready to be pasted into your preferred messaging app or email client.

* For larger secrets, Keyra will offer the option to export them as a file, which you can also share through your preferred communication channel.

The secret armored text is now available on your clipboard.

Simply paste it into your preferred messaging app or email client and send it to the team members you want to collaborate with.

Recipients can then import the secret into preferred vault.

To import the shared secret, copy the entire ASCII-armored text from the received message, starting with "KEYRA::...".

Paste the copied text into preferred Keyra vault to importing the secret.

Note: Keyra will recognize your collaboration status and allow you to import the secret into any vault of your choice.

Create an additional vault to establish a separate security domain. Each vault has its own security boundaries and access permissions.

Note: Keep the number of collaborators per vault limited to those who genuinely need access. The security of a shared vault depends on every collaborator. A single misconfiguration or compromised collaborator can put the entire shared vault at risk.

Enter a unique name for your new vault.

Choose a descriptive name that clearly identifies its purpose and contents. If the vault is intended for sharing with a specific person (e.g., Bob), consider naming it after that person to make the shared security domain easy to recognize.

Your newly created vault has its own independent security domain.

You can now securely share it with your chosen recipient (e.g., Bob).