> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/drive-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/drive-support/playbooks/create-a-new-vault-2.md).

# Create a new Vault

**What you'll do:** Create an encrypted vault — a security-first container, separate from your everyday Drive, that can hold Shadow Layers.

**Why it matters:** Vaults give you strong separation (each has its own keys) and are the only place Shadow Layers live. Use one for anything that needs more protection than everyday storage.

**Steps**

1. From **My Drive**, choose **Create vault** (New vault).
2. **Name the vault** and **set a password**. The password is part of the encryption — make it strong and unique.
3. **Choose how the vault key is stored:**
   * **Convenience** — the vault key is *not* stored; password reset relies on your keys.
   * **Security** — you store and manage the vault key yourself, for tighter control.
4. **Save the Vault Recovery Key** somewhere durable. It's the only way back in if you forget the password.
5. Finish. The app will **suggest creating a Shadow Layer** — add one now if you want plausible deniability (see [Create a Shadow Layer](/drive-support/shadow-layers/how-shadow-layers-work.md)).
6. Open the vault with its password and start adding files.

**Common mistakes**

* **A weak or reused vault password.** Unlike the device PIN, this password *is* cryptographic. Treat it like the key to a safe.
* **Not saving the Vault Recovery Key.** Forgotten password + no recovery key = the vault is gone.
* **Picking a key-storage mode without understanding reset.** Your choice determines how a future password reset works — see [User Key, Recovery & Devices](/drive-support/concepts-in-1-minute/user-key-recovery-and-devices.md).

> You can rename the vault, change its password, hide it, or delete it later from the vault's context menu — see [Change a vault password](/drive-support/playbooks/work-with-data.md) and [Remove or delete a vault](/drive-support/playbooks/remove-or-delete-a-vault.md).