Hermes Vault: Setup Step By Step

The Hermes vault is the encrypted store inside Hermes Agent that keeps your website logins, two-factor keys, cards and addresses, and fills them into pages without the model ever seeing them. New in v0.22.6: you can keep the vault's encryption key in your operating system's keychain instead of a file, with hermes vault key migrate --to keychain.

📺 Watch: NEW Hermes Agent Updates are INSANELY GOOD!

🔥 Get the Agent OS as a free bonus: AI Profit Boardroom members get the full Agent OS zip, prompt libraries, daily tutorials and weekly live coaching calls. → Get inside

Nous Research released Hermes Agent v0.22.6 on 2 November 2026. Its notes list "opt-in OS-keychain storage for the vault key". The docs page for the feature is called Passwords and Logins.

We covered the basics in our earlier Hermes credential vault guide. This page covers what is new: the keychain option, how to set it up, what changes when you switch, and how the vault compares to keeping secrets in a plain env file.

What the Hermes vault does

Say "log into GitHub" and the agent signs in for you. The first time it hits a sign-in page with no saved login, Hermes asks you in a masked prompt. After that it just works. Per the docs, the password is encrypted on your machine and injected straight into the page. The tool result the agent sees only says how many fields it filled and on which site.

The vault also handles:

Two-factor codes. Save the authenticator setup key with a login and Hermes generates the code. Codes sent to your phone get a small prompt. Passkeys and app approvals wait for you to tap.
1Password and Bitwarden. If the op or bw tool is installed and signed in, Hermes picks it up. You unlock once per session, with a 30-minute idle timeout.
Cards and addresses. Bound to the checkout site. Every card fill asks you first. Cron jobs, webhooks and the API server cannot confirm, so card fills there are refused.

Fills are refused unless the page's origin exactly matches the saved one. There is nothing to set up for the basics.

Want to build agents that log in and do real work for your business, safely? The AI Profit Boardroom has the training and weekly calls for $69/mo.

What is new in the Hermes vault: keychain key storage

By default the vault's key sits in a file, vault.key, in the vault folder of your Hermes home, next to the encrypted vault.json.enc. Both files are readable only by your user.

The new option moves that key into your OS keychain: macOS Keychain, Windows Credential Manager, or the Secret Service or KWallet on Linux. The vault itself stays where it is. Only the key moves.

Why it matters: with the file, the key and the vault travel together. Anyone who gets a backup or synced copy of your Hermes folder gets both. With the keychain, a copy holds only ciphertext.

📺 Watch: NEW Hermes Agent Update Changes AI! 🤯

How to set up Hermes vault keychain storage

Update Hermes. CLI users run hermes update. Docker and Hermes Cloud use the stable image. The Microsoft Store app updates through the Store. The Desktop installer app gets it with the next bundled release.
Check where the key is. Run hermes vault key. It shows the current location and whether a keychain is reachable.
Move it. Run hermes vault key migrate --to keychain. Hermes installs the small keychain feature if needed.
Move it back any time with hermes vault key migrate --to file.

The move is careful. Hermes writes the key to the keychain, checks that the keychain copy decrypts your vault, and only then deletes vault.key. If the move is interrupted, your vault still works, and running the command again finishes it.

The move also sets vault.key_storage in config.yaml to keychain. That setting decides where a new vault's key goes. The default is file. On a headless Linux server or an SSH session with no keyring, a new vault's key falls back to the file, with a warning in the log.

Each profile gets its own keychain entry. Its name sits in vault.keyref, which holds no secret. A profile cloned with hermes profile create --clone-all gets its own entry too.

📺 Watch: NEW Hermes Agent OS is GETTING INSANELY BETTER! 🤯

Hermes vault: file key vs keychain vs env file

This table is based on the "who can get at the vault" section of the Hermes docs, plus how Hermes stores provider API keys.

Who	Vault key in file (default)	Vault key in OS keychain	Plain .env file
Other non-admin users on the computer	Blocked	Blocked	Depends on file permissions
Someone with a backup or synced copy	Can decrypt	Gets ciphertext only	Reads it as plain text
Someone with the powered-off disk, no disk encryption	Can decrypt	Needs whatever protects the keychain	Reads it as plain text
A program or plugin running as you	Can decrypt	Can still ask the keychain	Reads it
Admin, root or malware with your rights	Can decrypt	Can decrypt	Reads it

The vault and the env file do different jobs. The vault holds website logins, cards and addresses the agent fills into pages. The .env file in your Hermes home holds provider API keys. The Hermes secrets docs offer Bitwarden Secrets Manager, 1Password and a command helper to pull those keys at startup "instead of storing them in plaintext". If you already use 1Password, our Hermes 1Password guide covers that side.

Hermes vault keychain trade-offs

The docs list three things that change in keychain mode. They are why Nous Research made it opt-in rather than the default.

Backups hold the vault without its key. hermes backup, a synced folder or a disk image no longer carries everything. Before you move a profile to another machine, run hermes vault key migrate --to file.
The keychain may ask. macOS can ask if Hermes may use the entry, for example after an update. A locked Linux keyring asks to be unlocked. Cron jobs that run while you are logged out cannot read the key, so their local logins fail with a clear error.
A lost entry means lost items. If the keychain entry is deleted, the vault cannot be opened. Hermes says so instead of making a new key over it. Restore the entry from a keychain backup, or start over.

Plugins are the other boundary. A third-party plugin running inside Hermes can do anything Hermes can, including filling a saved login. The docs suggest running unreviewed plugins out of process with plugins.isolation set to host.

Not sure which setup fits a server that runs cron jobs overnight? Book a free AI strategy session and we will map it out.

Want a second pair of eyes on where your keys, logins and API secrets should live? Grab a free AI strategy session.

Managing the Hermes vault day to day

In the Desktop app, open Settings, Passwords and Logins to see everything saved, unlock or lock detected password managers, and add or remove items. On the CLI:

hermes vault list shows saved items.
hermes vault add saves a login, card or address.
hermes vault rm plus a handle removes one.
hermes vault sources manages 1Password and Bitwarden. Use --disable bitwarden to turn one off.
hermes vault key handles the key location.

Items are scoped to the profile. Labels, site origins and login names are visible metadata. Passwords and card values never leave the vault except into the page.

Building a full agent stack around Hermes? The Agent OS guide shows how the pieces fit. For which model to run behind it, see Julian's own testing at Goldie Bench. Other v0.22.6 changes include the Hermes Webapp and migrating Grok Bot to Hermes.

Hermes vault FAQ

Is the Hermes vault made by Hermes Labs?

No. The vault is part of Hermes Agent by Nous Research. Hermes Labs is a separate, independent company.

Is keychain storage on by default?

No. The default is the vault.key file. Keychain storage is opt-in because backups no longer carry the key and a lost keychain entry means lost items.

Does the model ever see my passwords?

Per the docs, not through Hermes: not in tool results, logs, the session database or process arguments. The site you log into still gets the password, as when you type it yourself.