The Hermes vault is the part of Hermes that signs your agent into websites, enters 2FA codes and fills checkout forms, while the model only ever sees a field count and a site origin.
Hermes v0.22.6 shipped on 2 November 2026, and it adds one opt-in change worth acting on: the key that unlocks the vault can now live in your operating system's keychain instead of a file.
Below is the order I'd set it up in, from the first saved login to the keychain move, plus the gotchas that bite on servers and scheduled jobs.
If you'd rather have my team map which logins to hand to an agent first, book a free SEO strategy session.
What The Hermes Vault Stores, And What The Model Sees
The Passwords & Logins docs list four kinds of item: website logins, authenticator setup keys, payment cards and addresses.
Every item is bound to a site origin, such as https://github.com, and only fills on that exact origin.
Items are encrypted under ~/.hermes/vault/ and scoped to the active profile.
The labels, origins and usernames are readable metadata, which is how the agent picks the right login.
Passwords and card numbers stay inside the vault and only leave it to go into the page.
After a fill, the tool result handed back to the model reads like {filled_fields: 1, origin: "https://github.com"} and nothing more.
Hermes also registers the password with its redactor, so a later page read can't echo it back into the chat.
Step 1: Update To v0.22.6 Before You Touch The Key
The keychain commands arrived with the v0.22.6 release, listed there as opt-in OS-keychain storage for the vault key.
On the CLI, run hermes update or re-run the installer one-liner.
Docker and Hermes Cloud users pull nousresearch/hermes-agent:stable.
The Microsoft Store app updates itself through the Store.
The Desktop app from the .exe or .dmg installer doesn't change in this release and picks the feature up with the next bundled build.
So if you run Desktop from the installer, do the keychain step from a CLI install on the same machine, or wait for that bundled release.
Step 2: Save Your First Login From The Masked Prompt
There's no setup screen to fill in first.
Tell the agent "log into GitHub" and let it reach the sign-in page.
With no saved login for that site, the CLI or TUI shows a 🔐 Save login for github.com prompt.
You type the email or username, which is shown, then the password, which is hidden.
On Desktop you get a "Save your github.com login?" card with the same two fields.
Save & sign in stores it and carries on, while Don't save stops the agent asking for the rest of that turn.
From then on, the agent lists saved logins, types the username itself and asks Hermes to fill the password.
The one habit to drop: never paste a password into the chat box, because the masked prompt is the route that keeps it out of the conversation.
🔥 Want the vault wired into a full agent setup, not just one login? Inside the AI Profit Boardroom you get step-by-step video trainings, the installable Agent OS with Hermes ready to go, four coaching calls a week and 3,400+ members swapping their login and browser setups. → Join the AI Profit Boardroom
Step 3: Add 2FA Setup Keys So Codes Fill Themselves
When you turn on two-factor at a site, it shows a setup key or an otpauth:// link.
Save that key with the login, either in Settings → Passwords & Logins → Add or with hermes vault add.
The item gets a 2FA auto badge, and Hermes generates and enters the current code without asking anyone.
The code is only made for a page on that login's saved site, the same rule as the password.
TOTP seeds already stored in 1Password or Bitwarden items count too.
Codes sent by SMS or email work differently: a small "Verification code for github.com" prompt appears, you type it, and Hermes enters it.
Passkeys, hardware keys and "tap Approve" app prompts need nothing typed; the agent tells you to finish on your device and waits.
Step 4: Let Hermes Pick Up 1Password Or Bitwarden
If the op or bw command-line tool is installed and signed in, Hermes detects it with no switch to flip.
The first time the agent needs one of those logins, you unlock the manager with your master password in a masked prompt.
That unlock lasts for the session and locks again after 30 idle minutes.
Hermes passes the master password to op signin on stdin, or to bw unlock --passwordenv through the child's environment, and keeps only the session token in memory.
An item listing several URLs fills on each of those exact origins and nowhere else.
To keep a detected manager out of the picture, run hermes vault sources --disable bitwarden or use the switch in Settings.
Want a different manager, such as KeePass? The browser vault plugin guide only accepts those backends from verified vendor or official Nous catalog entries, and each stays off until you set it to enabled: true.
Step 5: Save Cards And Addresses, And Know Which One Asks
Cards and addresses are added the same way as logins and are bound to the checkout site.
Every card fill stops for approval, using the same prompt Hermes shows before a dangerous command.
Say no and nothing is written to the page.
Address fills go straight through with no confirmation.
Cron jobs, webhooks and the API server can't answer that card prompt, so Hermes refuses card fills there outright.
The docs spell out the effect: a prompt injection that lands on a checkout page can ask, but it can't spend.
Step 6: Move The Vault Key Into Your OS Keychain
By default the key sits in ~/.hermes/vault/vault.key with 0600 permissions, right beside vault.json.enc.
Since v0.22.6 you can move it into your OS store instead: macOS Keychain, Windows Credential Manager, or on Linux the Secret Service or KWallet.
Check where it is now and whether a keychain is reachable:
hermes vault keyThen move it:
hermes vault key migrate --to keychainIf the small keychain feature isn't installed yet, that command installs it.
The move writes the key to the keychain, checks that copy can actually decrypt your vault, and deletes vault.key only after that check passes.
If the move gets cut off halfway, the vault still opens, and running the same command again finishes the job.
Changed your mind? Run hermes vault key migrate --to file.
The migrate command also writes vault.key_storage, which only decides where a new vault's key goes:
vault:
key_storage: file # default; or: keychainWhat Keychain Mode Changes On A Real Machine
This is why the feature is opt-in, so read it before you migrate.
Backups no longer carry the key. hermes backup, a synced ~/.hermes folder or a disk image holds the vault without the key to open it.
Moving to a new laptop? Run hermes vault key migrate --to file first, copy the profile, then move the key back.
The keychain may ask. macOS can ask whether Hermes may use the entry, for example after an update swaps Hermes' Python, and a locked Linux keyring asks to be unlocked.
A deleted entry means a vault you can't open. Hermes tells you rather than writing a fresh key over it, and your options are a keychain backup or deleting vault.json.enc to start again.
Each profile gets its own keychain entry, named in ~/.hermes/vault/vault.keyref, a file that holds no secret.
A profile made with hermes profile create --clone-all gets its own entry while it's being created, and the clone is refused with a message if the keychain can't be reached at that moment.
A renamed profile switches to an entry of its own the first time it opens its vault and leaves the old entry alone.
Headless Servers, Cron Jobs And hermes chat -q
Cron jobs, webhooks, the API server and hermes chat -q have nobody to answer a prompt.
Saved local logins keep working there.
A locked password manager returns unavailable_in_this_session, and a site with no saved login returns prompt_unavailable.
The fix is to unlock or save from an interactive session first, or give 1Password a service account token through OP_SERVICE_ACCOUNT_TOKEN.
Two keychain-specific traps apply here.
On macOS, a cron job that runs while you're logged out can't read the key, so its local logins fail with a clear error.
On a headless Linux box or an SSH session with no desktop keyring, key_storage: keychain quietly falls back to vault.key for a new vault and logs a warning.
My rule: keep the file key on servers that run unattended jobs, and use the keychain on the laptop you sit at.
📞 Planning which client logins an agent should hold? Book a free SEO strategy session and my team will help you decide what to automate first and what stays manual. → Book your free session
Camofox Users: The One URL Rule To Check
Standard browser fills go over the supervised session's direct CDP socket, and the origin is checked again inside the page right before the write.
Camofox has no CDP endpoint, so Hermes runs the same checks and sends the fill to the Camofox tab through its REST evaluate endpoint.
That only happens when CAMOFOX_URL is loopback or HTTPS.
My Hermes Camofox setup walkthrough covers the server and plugin side; for the vault, just confirm that URL before you rely on fills.
Lock Down Plugins Before You Save Work Logins
The docs are blunt here: a third-party plugin running inside the Hermes process has the same powers as Hermes, and that includes filling in a saved login.
If you've installed plugins you haven't reviewed, run them out of process with plugins.isolation: host, as described in the plugins docs.
A plugin host still runs as your user and can read your files, so give it a sandbox with plugins.host.launcher when you want a hard boundary.
I'd do this before saving a single client or bank login.
What The Vault Does Not Cover
Once a password goes into a site, that site and its scripts have it, the same as when you type it yourself.
On a cloud browser backend, the vendor's browser sees the page like any other.
The origin binding stops a fill on the wrong site; it doesn't vouch for the right one.
Anyone with admin rights on the machine can still decrypt in either mode, according to the docs' access table.
The Hermes Vault Command Sheet
| Command | What it does |
|---|---|
hermes vault list | Lists everything saved in this profile |
hermes vault add | Adds a login, 2FA key, card or address |
hermes vault rm <handle> | Removes one item by its handle |
hermes vault sources | Shows detected managers; add --disable bitwarden to switch one off |
hermes vault key | Reports where the key is and whether a keychain is reachable |
hermes vault key migrate --to keychain | Moves the key into the OS keychain |
hermes vault key migrate --to file | Moves it back to vault.key |
The same list, plus Unlock and Lock for detected managers, lives in Desktop → Settings → Passwords & Logins.
Profiles keep separate vaults, so set one up per client or per job using the profiles guide.
My Setup Order, In One Pass
- Update with
hermes updateand confirm you're on v0.22.6. - Set
plugins.isolation: hostif any plugin is unreviewed. - Save logins as the agent meets each sign-in page.
- Add 2FA setup keys so codes fill on their own.
- Unlock 1Password or Bitwarden once, or disable the one you don't want.
- On your own laptop, run
hermes vault key migrate --to keychain, thenhermes vault keyto confirm. - On unattended servers, leave the file key in place.
Want the whole Agent OS around this, with trainings and live calls? Join the AI Profit Boardroom.
Also On Our Network
- 🌐 How a shop, a service firm and an agency hand logins to an agent
- 🌐 A ten-criteria scorecard rating password isolation, 2FA and keychain storage
- 🌐 Five copy-paste prompts that run the vault inside your Agent OS
- 🌐 Which AI models to pair with the vault, with live GoldieBench scores
- 🌐 The complete Hermes vault guide on the AI Profit Boardroom blog
FAQ: Hermes Vault
Where does the Hermes vault keep my passwords?
Encrypted under ~/.hermes/vault/ in vault.json.enc, scoped to the active profile. The key sits in vault.key unless you move it to the OS keychain.
Do I have to set anything up before the agent can log in?
No. The first time the agent hits a sign-in page with no saved login, Hermes asks you in a masked prompt and saves it from there.
Can I undo the keychain move?
Yes. Run hermes vault key migrate --to file and the key goes back to vault.key.
Why do my cron logins fail after moving to the keychain?
On macOS, cron jobs that run while you are logged out cannot read the keychain entry. Keep the file key on machines that run unattended jobs.
Does the 2FA auto badge work with Bitwarden items?
Yes. 1Password and Bitwarden items that hold a TOTP seed count, and the code is only generated for the login's saved site.
📺 Video notes + links to the tools 👉
🎥 Learn how I make these videos 👉
🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉
About Julian
I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.
I help business owners scale with AI agents, automation and SEO.
- I've built a 7-figure SEO and link building agency, Goldie Agency, with a team of 70+ SEO experts.
- I've grown a YouTube channel to 400,000+ subscribers.
- I wrote "Link Building Mastery".
- My Udemy courses have taught over 29,000 students.
→ Get my best AI training inside the AI Profit Boardroom
Run hermes vault key today, migrate on the machine you sit at, and book a free SEO strategy session if you want a hand deciding which logins go into your Hermes vault.
