A master password unlocks encryption keys on your device. Multi-factor authentication protects something adjacent but distinct: who is allowed to reach the account that stores and syncs your ciphertext. Mixing those layers produces dangerous designs — especially “recovery” flows that only work because someone else can open your vault.
In Vault App, MFA raises the cost of a stolen account password. It does not give us a second key to your notes and logins. After MFA succeeds, you still unlock locally. The vault remains sealed until your master password derives the keys on a device you control.
Two doors, one set of keys
Think of account login as the front door to the building where sealed boxes are stored. MFA is a better lock on that door. The master password is the key to every box. Improving the front door should never require leaving copies of box keys at the front desk.
That split is why MFA and zero-knowledge can coexist. You get stronger protection against account takeover without turning the provider into a key escrow service. Compromised email or a phished login should not equal a decrypted vault.
Trusted devices and friction
MFA on every visit can be noisy on a machine you already control. Trusted devices let you mark hardware you own so you are not challenged on every sign-in — for a limited window, on that device only. Trust stays explicit and revocable. If a laptop is lost, remove the device and force MFA again.
Convenience features should never quietly widen who can open vault contents. Trusted devices are a controlled exception to MFA friction, not a bypass of encryption. Your master password and local keys remain the unlock for secrets.
Use both layers
Enable MFA. Keep recovery codes somewhere worthy of vault-level secrets — ideally an encrypted note you already protect with the same master password model. Review trusted devices when your hardware changes.
Treat MFA as account hygiene and the master password as cryptographic control. The hard guarantee — unreadability of vault contents — still rests on client-side encryption. MFA makes it harder for someone else to stand at the door while you hold the only keys that open the boxes.