Hermes Vault: Let Your Agent Log In Without Seeing Your Passwords

The Hermes vault is how Hermes Agent signs into websites, enters two-factor codes and fills your address or card at checkout without the model ever seeing a password. Say “log into GitHub” and, the first time, Hermes asks you for the login in a masked prompt. After that it just works. The newest change landed in Hermes v0.22.6 on 2 November 2026: you can now keep the vault’s encryption key in your computer’s own keychain instead of a file. Below is what the vault stores, the commands, password manager support, the keychain option and the limits to know. My video is right under this intro.

What does the Hermes vault store?

The Passwords & Logins docs describe four kinds of item, all encrypted on your machine under ~/.hermes/vault/ and kept per profile:

• Website logins: your username or email plus the password, tied to the exact site (for example https://github.com).
• Two-factor setup keys: the “setup key” or otpauth:// link a site shows when you turn on 2FA. Hermes then generates the code itself, and the item shows a 2FA auto badge.
• Cards for checkout pages.
• Addresses for shipping and billing forms.

Labels, site addresses and usernames are visible metadata. Passwords and card numbers never leave the vault except into the page they belong to.

How the vault keeps passwords away from the model

When Hermes fills a password, the tool result the model sees is just a note like {filled_fields: 1, origin: "https://github.com"}. The docs list what that means:

• The password never enters the model’s context through Hermes: not tool results, logs, the session database or any command line.
• A fill is refused unless the page address exactly matches the saved site, checked again inside the page right before writing.
• The password is also registered with the redactor, so a later page read can’t echo it back.
• Codes sent to your phone or email are typed into a small prompt by you and entered by Hermes; they never enter the chat either.
• For passkeys, hardware keys and app approvals (“tap Approve in Duo”), Hermes tells you to finish on your device and waits.

Add and manage logins

Most people never run a command: the first time the agent hits a sign-in page with no saved login, it asks you on the spot. In Hermes Desktop you see a “Save your github.com login?” card with Save & sign in or Don’t save.

To manage things yourself, use Desktop → Settings → Passwords & Logins, or the CLI:

hermes vault list
hermes vault add
hermes vault rm <handle>
hermes vault sources
hermes vault key

Easier option: ask your agent, “Show me what’s saved in my Hermes vault and remove any login I haven’t used for a site I no longer need.”

Use 1Password or Bitwarden with Hermes

Nothing to switch on. If the op or bw command-line tool is installed and signed in, Hermes picks it up and those website logins become fillable next to the local ones.

• The first time a manager login is needed, Hermes asks for your master password in a masked prompt, once per session, locking again after 30 minutes idle.
• Hermes keeps only the session token in memory, never the master password.
• An item listing several websites fills on each of those exact addresses and nothing else.
• Opt out with hermes vault sources --disable bitwarden or the switch in Settings.

For unattended jobs, the docs suggest a 1Password service account token (OP_SERVICE_ACCOUNT_TOKEN), because a locked manager can’t be unlocked when nobody is there.

Cards and addresses: what needs your OK

Cards and addresses are saved once and filled only on their checkout site. The safety rule that matters most for a business:

• Every card fill asks you first, with the same approval prompt as a dangerous command. Declining writes nothing.
• Cron jobs, webhooks and the API server can’t confirm, so card fills there are refused. A prompt injection that reaches a checkout page can ask, but it can’t spend.
• Address fills need no confirmation.

New: keep the vault key in your OS keychain

By default the encryption key sits in ~/.hermes/vault/vault.key next to the encrypted vault. v0.22.6 adds an opt-in move to the macOS Keychain, Windows Credential Manager, or Secret Service / KWallet on Linux:

hermes vault key                          # where the key is now
hermes vault key migrate --to keychain    # move it into the keychain
hermes vault key migrate --to file        # move it back

The move copies the key, checks the keychain copy opens your vault, and only then deletes the file, so an interrupted move still leaves a working vault. It also sets vault.key_storage for new vaults.

Why bother: with the default file, anyone holding a backup or synced copy of ~/.hermes can decrypt the vault because the key travels with it. With keychain storage, a backup holds only scrambled data.

Keychain mode trade-offs

The docs explain why it’s opt-in rather than the default:

• Backups don’t carry the key. Before moving a profile to another machine, run hermes vault key migrate --to file.
• The keychain may ask. macOS can ask whether Hermes may use the entry (for example after an update), and a locked Linux keyring asks to be unlocked. Cron jobs running while you’re logged out can’t read the key.
• A lost entry means lost items. Delete the keychain entry and the vault can’t be opened; Hermes says so rather than creating a new key over it.
• On a headless Linux server with no keyring, a new vault’s key falls back to the file with a warning.

One limit applies in both modes: a plugin running inside Hermes can do anything Hermes can, including filling a saved login. If you save logins and install plugins you haven’t reviewed, the docs recommend running plugins out of process with plugins.isolation: host.

My verdict

If your agent logs into tools, pays for things or fills forms for your business, use the vault instead of pasting passwords into chat. Leave card approval on, and move the key to your keychain if you back up or sync ~/.hermes. That’s the safe way to use the Hermes vault.

About Julian Goldie

I’m Julian Goldie — founder of Goldie Agency and the AI Profit Boardroom. I test new AI agents almost every day for 432K+ YouTube subscribers and run Hermes, OpenClaw, OpenCode, Claude and Codex side by side in my own Agent OS. Claim your free strategy session or join the AI Profit Boardroom.

Want another angle? Read the AI Profit Boardroom guide to Hermes Vault.

FAQ: hermes vault

What is the Hermes vault?

It is Hermes Agent’s encrypted store for website logins, two-factor setup keys, cards and addresses. Hermes fills them straight into the right page, so the model never sees the passwords.

How do I add a login to the Hermes vault?

Let the agent ask the first time it reaches a sign-in page, or use Desktop Settings, Passwords and Logins, Add, or run hermes vault add in the CLI.

Does Hermes work with 1Password or Bitwarden?

Yes. If the op or bw command-line tool is installed and signed in, Hermes detects it and can fill those logins after you unlock the manager with your master password once per session.

Can the Hermes vault pay with my card on its own?

No. Every card fill asks you first, and unattended runs such as cron jobs and webhooks are refused, so a card is never charged without your approval.

What is the new Hermes vault keychain option?

Added in v0.22.6 on 2 November 2026, it lets you move the vault encryption key from a file into the macOS Keychain, Windows Credential Manager or a Linux keyring with the hermes vault key migrate command.

Should I use keychain storage for the Hermes vault?

Use it if you back up or sync your Hermes folder, because backups then hold no key. Skip it for cron jobs that run while you are logged out, and move the key back to a file before changing machines.

Related reading

• Hermes Camofox
• Hermes Agent Browser
• Hermes Multiple Profiles

Last updated November 2026. This page is a living guide to hermes vault — the facts here move fast and it is updated as they do.