Run your own server

Choose the server mode

Secretinio Server runs on .NET 10 and uses the same build for two deployment modes. Clients encrypt and decrypt vault contents; the server stores encrypted data, public keys, permissions, authentication state, and signed records.

Mode	Use it for	Default policy
Organization	A private organization installation	Invitation-only registration; organization creation restricted to server administrators
Public	Personal-vault hosting plus organizations	Open registration; active users can create organizations

Both registration and organization-creation policies are configurable. Public mode does not make vault contents public. It is also the mode for a privately operated personal-sync server.

Download and verify the server

Get the Windows x64 ZIP or Linux x64 archive and its SHA-256 checksum file from Server downloads. These are framework-dependent packages: install the .NET 10 ASP.NET Core Runtime on the target machine first (the SDK is not required, only the runtime). Linux still needs the standard operating-system dependencies for .NET 10 on your distribution.

Extract the complete archive. Keep the executable, native SQLite/libsodium libraries, configuration, and documentation together. The executable retains its compatible name: PasswordVault.Server.exe on Windows and PasswordVault.Server on Linux.

Prepare trusted HTTPS and storage

Use a dedicated unprivileged service account and an absolute local data directory outside the extracted application folder. Create the directory before the first start, owned by that account and with mode 700 (install -d -m 700): it holds the databases, the setup token and the key ring that wraps server-side multi-factor secrets. For upgrades, back up first and retain the existing data directory, deployment mode, and public origin.

Obtain a TLS certificate trusted by your client devices and valid for your server's hostname. The examples below configure a PFX certificate directly in Kestrel. Replace the example certificate path, passphrase, hostname, and data path with your own values. Supply the real certificate passphrase through protected service configuration or a secret manager; do not commit it or leave it in shell history.

The public origin must exactly match the HTTPS address clients use, including a non-default port. https://0.0.0.0:7443 is only the listening address; clients in these examples connect to https://vault.example.com:7443. The Secretinio website address does not automatically provide a vault server.

Install on Windows x64

Install the .NET 10 ASP.NET Core Runtime (x64) if it is not already on the machine. In PowerShell, verify the ZIP and extract it into a new directory:

$archive = '.\Secretinio-server-win-x64.zip'
$expected = (Get-Content ($archive + '.sha256') -Raw).Trim().Split(' ')[0]
$actual = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash
if ($actual -ne $expected) { throw 'Server archive checksum mismatch.' }
Expand-Archive -LiteralPath $archive -DestinationPath '.\secretinio-server'
Set-Location '.\secretinio-server'

For an initial foreground run under the service account, configure the certificate and start the server:

$env:Kestrel__Certificates__Default__Path = 'C:\Certificates\vault.pfx'
$env:Kestrel__Certificates__Default__Password = '<certificate passphrase>'
.\PasswordVault.Server.exe --urls https://0.0.0.0:7443 --Vault:PublicOrigin https://vault.example.com:7443 --Vault:Mode Organization --Vault:DataDirectory C:\SecretinioData

Install on Linux x64

Install the .NET 10 ASP.NET Core Runtime for your distribution (see Microsoft's Linux install guide) if it is not already present. Verify the archive before extraction. Continue only if the checksum command reports OK:

sha256sum --check Secretinio-server-linux-x64.tar.gz.sha256

Extract into a new directory, then run under the dedicated service account with the prepared data directory and certificate:

mkdir secretinio-server
tar -xzf Secretinio-server-linux-x64.tar.gz -C secretinio-server
cd secretinio-server
chmod +x PasswordVault.Server
sudo install -d -m 700 -o secretinio -g secretinio /var/lib/secretinio
export Kestrel__Certificates__Default__Path='/etc/secretinio/vault.pfx'
export Kestrel__Certificates__Default__Password='<certificate passphrase>'
./PasswordVault.Server --urls https://0.0.0.0:7443 --Vault:PublicOrigin https://vault.example.com:7443 --Vault:Mode Organization --Vault:DataDirectory /var/lib/secretinio

The commands use Organization mode for a private organization installation. Choose --Vault:Mode Public for personal-vault hosting plus organizations. Both modes keep vault contents encrypted and support configurable registration and organization-creation policies.

For unattended operation, use your operating system's service manager and protect its configuration and certificate files. Allow network access only as intended, especially before the first setup is claimed. These instructions run the standalone executable.

Complete the client setup wizard

1. Start the server and add its HTTPS origin in Manage servers in the Windows app.
2. Choose Connect / discover. An unconfigured installation opens the setup wizard.
3. Set the server name, registration policy, organization-creation policy, and limits. Enroll an authenticator.
4. The identity that successfully completes setup becomes the server superadmin. Appoint additional trusted administrators through the server controls.

The default FirstUser setup mode lets the first connecting identity claim an empty server. Restrict network access while provisioning, or select Vault:SetupMode=Token. Token mode requires the one-time setup token stored in the installation's data directory. Do not expose an unclaimed installation unintentionally.

Operate and back up

Run one server process against local storage. Each organization has a separate SQLite file, coordinated by server.db; personal identities have separate vault files too. Do not put these databases on a network share or run replicas against the same directory.

Back up the complete registered database set, checksum manifest, configuration, and server protection-key directory. Those protection keys secure server-side MFA state; they are not vault decryption keys. Use the documented backup tools rather than copying individual live database files.

Restore offline into a fresh data directory and preserve the public origin. Individual organization export exists, but isolated organization restore/import is not implemented. Upgrade the server and clients together, preserve backups and trusted custodian devices, and review the current release limits before deployment.