# nornir-vault — for idiots
> **Class:** `idiot` · Zero-knowledge walkthrough. Stub — expand as korp wiring lands.
## What is this?
A little locked box on the thin client's disk that holds its secrets (a login
certificate, a Spark token). Without the key, the box is scrambled bytes. This
stops someone who is looking at the container's screen/disk from just reading the
secrets straight off the filesystem.
## The one idea: two keys, like a safe-deposit box
1. There is a **content key** (the DEK) that scrambles the secrets. It is random
and you never see it.
2. That content key is itself locked inside the box by a **door key** (the KEK).
3. Your **PIN** makes the door key (via a slow, deliberately-expensive step called
Argon2id, so guessing is painful). Or, on the desktop, the door key can live in
the **OS keyring** so the box opens without a PIN prompt.
Open the box (unlock) and the secrets appear **in memory only** — never written
back to the disk unscrambled. Close it (lock) and they are wiped.
## What you do
1. **Create** the box with a PIN. It starts open.
2. **Put** the cert / token in.
3. **Lock** it (or just quit — it is already saved scrambled).
4. Next time: **open** the file, type the PIN, **read** the secret.
## Careful
* Type the wrong PIN too many times (default 5) and the box **locks itself** — on
purpose. Then even the right PIN will not open it; you start a fresh box.
* Never print or log a secret. The types are built to refuse, so do not fight them.
## More
See [`vault-guide.md`](vault-guide.md) for the code and [`vault-design.md`](vault-design.md)
for how it works inside.