Troubleshooting
FAQ and common mistakes
Use this page when something feels confusing but not fully broken. It collects the mistakes users are most likely to hit during first setup and multi-device use.
Setup
Do I need a business account or verification?
No. GitVault sync needs a normal GitHub account, a private repository, and a fine-grained token scoped to that repository.
Can I use GitVault without GitHub sync?
Yes, but the vault stays local to that device. Use GitHub sync when you want encrypted backup, device linking, or restore from another device.
Can GitVault recover my vault if I lose the phrase?
No. GitVault cannot decrypt the vault without the recovery material and valid access flow.
Sync
Why does sync fail right after I paste a GitHub token?
The most common cause is token scope. Use a fine-grained token for the exact private repository with Metadata read and Contents read/write permissions.
Does GitHub see my passwords or notes?
No. GitVault encrypts vault data before upload. GitHub stores encrypted files, not readable secrets.
Why does a change show on one device but not another?
Sync the source device first, then sync the target device. If both devices edited the same item offline, the newest synced item version wins.
Devices
Why did I get an alert even though the device is mine?
The device may have appeared outside the Link New Device invite flow, or the trusted state may not have synced yet. Recognize it only if the timing and device match your own action, then sync.
Why is another device missing from the list?
That device must link, restore, and sync before other devices can see it. Open GitVault on that device and run sync after setup.
Does removing a device erase its local storage immediately?
It is marked untrusted after the removal syncs. When that device opens or checks trust with network access, GitVault clears local sync access and requires linking or recovery again.
Recovery
Should I link or restore a new phone?
Use Link New Device when a trusted device is still available. Use Restore Device when you are setting up from recovery instead of a trusted invite.
Why do lost-device recovery steps ask for a new GitHub token?
If no trusted device can approve the request, a newly generated token for the same repository proves current GitHub account control.
When should I revoke the old token?
After recovery succeeds and GitVault confirms sync works with the new token.
Autofill
Why does Android autofill not appear?
GitVault must be selected as the Android autofill provider. If a browser or app still does not show it, try Chrome or use GitVault Keyboard.
Does web support system autofill?
No. System-wide autofill is an Android integration. The web app supports vault use in the browser.
Updates
Why is the web version still old?
GitHub Pages deployment can lag the release tag. Wait for Pages to finish, then reload the web app.
Why is there no APK on a new release?
The release workflow may still be running. Refresh after the APK build job finishes, then verify the asset with SHA256SUMS.txt.
Security
What should I do after an unexpected device alert?
Do not recognize it. Remove the device if it appears in Connected Devices, create a new GitHub token, update trusted devices, and revoke the old token.
Why is PIN input delayed?
Wrong attempts can trigger throttling. Wait for the timer, then enter the full PIN. On web, use the physical keyboard.