Docs / StarVault guide / Zero-Knowledge Credential Versioning, Rollbacks & Retention
Zero-Knowledge Credential Versioning, Rollbacks & Retention
- Automatic Rotation Snapshots: Whenever sensitive credentials (passwords, SSH/GPG keys, API tokens, TOTP secrets) are rotated, StarVault immediately captures an encrypted zero-knowledge version snapshot.
- Cryptographic Fingerprinting: Distinguishes authentic secret rotations from non-sensitive metadata edits (e.g. tag or folder updates) to maintain an uncluttered version timeline.
- Interactive Timeline & Visual Diff: The dedicated Version History Studio displays snapshot timelines, descriptive change summaries, decrypted credential reveals, and side-by-side field comparisons vs current live entries.
- 1-Click Rollback with Pre-Rollback Guard: Instantly revert any credential or keypair to a previous historical version. StarVault automatically preserves a pre-rollback snapshot before restoring so you can always undo.
- Physical Key Lifecycle Management: Links physical key files (
.pem,.pub,.ppk,.key,.crt,.asc) in StarVault's dedicated keys directory to version snapshots. When versions are deleted, associated physical files can be securely overwritten with random bytes and unlinked. - Configurable Retention Policies: Configure automated pruning rules in Settings by maximum age (days, months, years) and max versions per entry. Run on-demand cleanups or dry-run simulations with zero risk.
- Full Ecosystem Parity: Manage version histories and rollbacks via Desktop GUI inspector, Chromium Extension bridge (
/api/entry_versions,/api/restore_version,/api/clean_versions), and MCP server tools.
Updated 2026-10-31