The Hermes vault earns an 8.3 out of 10 from me: it is the cleanest answer I've read to letting an AI agent log in without the model ever holding a password.
That score is an editorial rating built from the official docs and the v0.22.6 release of 2 November 2026, not from a benchmark run.
v0.22.6 added opt-in OS-keychain storage for the vault key, and that change moves two of my scores in opposite directions.
Here is the full scorecard, the strengths, the limits, and who should switch it on.
Weighing agents for client work? Book a free SEO strategy session and talk it through with my team.
How I Scored It
Each criterion is something a buyer would ask before trusting an agent with logins.
Every score comes with one reason taken from the official docs, so you can check my reading against the source.
A 10 means the docs describe a design I can't see a way to improve for that job.
A 6 or 7 means it works, but with a trade-off you have to manage yourself.
The short version: turn the vault on for any agent that works behind a login, keep the file key on unattended servers, and isolate unreviewed plugins first.
The Scorecard
| Criterion | Score /10 | Reason from the docs |
|---|---|---|
| Keeping passwords out of the model | 10 | The tool result is only a field count and an origin, and the password is added to the redactor |
| Wrong-site protection | 9 | Exact-origin match, checked again inside the page just before the write |
| Setup effort | 9 | Nothing to configure; the first sign-in page triggers a masked save prompt |
| Two-factor handling | 9 | Setup keys generate codes automatically; SMS, email and passkeys stay with you |
| Card safety | 9 | Every card fill needs approval, and headless sessions are refused |
| Password manager support | 8 | 1Password and Bitwarden are auto-detected; other managers need a verified plugin |
| Key storage options | 8 | File by default, OS keychain opt-in since v0.22.6, with a safe two-way migrate |
| Unattended jobs | 7 | Saved local logins work, but locked managers and missing logins return errors |
| Portability and backups | 6 | Keychain mode leaves the key out of backups, so moves need an extra step |
| Plugin boundary | 8 | In-process plugins can fill logins; plugins.isolation: host fixes it but isn't automatic |
Average across the ten criteria: 8.3.
Six criteria score 9 or 10, and the lower marks all come from trade-offs the docs describe openly rather than from missing features.
That openness counts for something: the docs include a table of who can and can't reach the vault in each storage mode.
Strength: The Model Never Holds The Password
This is the core reason to rate it highly.
The Passwords & Logins docs state that the password never enters the model's context through Hermes.
That covers tool results, logs, the session database and the command-line arguments of any process.
The agent sees labels, site origins and usernames, which is enough to choose the right login and nothing more.
When a fill finishes, the model reads {filled_fields: 1, origin: "https://github.com"}.
I've not seen a tidier contract for this job.
Strength: Origin Binding Is Strict
Each saved item is tied to one exact origin.
Fills run over the supervised browser session's direct CDP socket and are refused if the page origin doesn't match.
The match is checked a second time inside the page right before anything is written.
Password manager items that list several URLs fill on each of those exact origins, with nothing guessed beyond them.
That strictness costs a little convenience on sites with many subdomains, and I think it's the right call.
If a login fails to fill, the usual reason will be an origin that differs from the one saved, and the fix is to save it for the right address.
That's a small price for a rule that never fills a password on a lookalike page.
Strength: Password Managers Join With No Setup
If the op or bw command-line tool is installed and signed in, Hermes picks it up without a setting.
You unlock the manager once per session with a masked prompt, and it locks again after 30 idle minutes.
The session token stays in Hermes' memory and is handed only to the single op or bw command that needs it.
Don't want a detected manager used? hermes vault sources --disable bitwarden switches it off.
It loses a point because anything beyond those two needs a vendor-verified or official plugin.
Strength: Two-Factor Without Copy-Paste
Save a site's setup key or otpauth:// link with the login and the item gets a 2FA auto badge.
Hermes then generates the current code and enters it, but only on that login's site.
Codes sent by text or email get their own small prompt, so they never enter the chat.
Passkeys, hardware keys and app approvals are left to you, and the agent simply waits.
That split is sensible: automate the codes you'd copy anyway, keep a human on the ones designed to need one.
🔥 Rated it, now want it running in a full agent stack? Inside the AI Profit Boardroom you get step-by-step video trainings, the installable Agent OS, four coaching calls a week and 3,400+ members comparing their Hermes setups. → Join the AI Profit Boardroom
Strength: Cards Always Wait For A Yes
Card fills use the same approval prompt Hermes shows before a dangerous command.
Decline it and nothing is written to the page.
Cron jobs, webhooks and the API server can't confirm, so card fills there are refused.
Address fills need no approval, which I'd call a fair line given what an address can do.
What v0.22.6 Changes In The Score
The v0.22.6 release notes list opt-in OS-keychain storage for the vault key.
It runs on two commands: hermes vault key for a status check, and hermes vault key migrate --to keychain to do the move.
The reverse, hermes vault key migrate --to file, puts things back the way they were.
The migrate step also sets vault.key_storage, which only controls where a brand-new vault's key goes.
Supported stores are Apple's Keychain on macOS, Credential Manager on Windows, and KWallet or the Secret Service on Linux.
The migration is careful: it writes the key, checks that the copy decrypts the vault, and only then deletes vault.key.
That lifts key storage to an 8.
It also pulls portability down to a 6, because a backup, a synced folder or a disk image now holds the vault without its key.
The docs' own access table shows the gain: someone holding a copy of ~/.hermes gets ciphertext only in keychain mode, versus a vault they can open in file mode.
Limit: Unattended Jobs Hit Edges
Saved local logins keep working in cron jobs, webhooks, the API server and hermes chat -q.
A locked password manager returns unavailable_in_this_session, though, and a missing login returns prompt_unavailable.
1Password users can set OP_SERVICE_ACCOUNT_TOKEN to cover that.
In keychain mode, cron jobs that run while you're logged out can't read the key and fail with a clear error.
On a headless Linux server, keychain storage falls back to the file key for a new vault and logs a warning.
None of this is hidden, which helps, but it's why unattended work scores a 7.
The workaround is simple enough: save every login a job needs from an interactive session before you schedule it.
It still means a human has to prepare each job, which some teams won't expect.
Limit: Plugins Sit Inside The Fence
The docs call plugins the boundary that matters.
Any third-party plugin loaded into the Hermes process inherits Hermes' full powers, saved-login fills included.
That's not a flaw unique to the vault, but it's the place most setups will be weakest.
Isolation is something you turn on yourself, which is why this row sits at 8 rather than 9.
The remedy is plugins.isolation: host from the plugins docs, plus plugins.host.launcher for a sandbox.
On the plus side, password manager backends from plugins are tightly gated: the browser vault plugin guide accepts them only from bundled, verified-vendor or official Nous catalog entries.
Limit: It Can't Vouch For The Website
Once the password is in a site's form, that site and its scripts have it.
Run Hermes on a hosted browser service and that provider's browser renders the page, password field and all.
Origin binding stops a fill on the wrong site, not misuse by the right one.
That's an honest limit, and every password tool shares it.
Camofox Fills Keep The Same Score
With the Camofox browser plugin, there's no CDP endpoint.
Hermes runs the same origin checks and fills through Camofox's REST evaluate endpoint, only when CAMOFOX_URL is loopback or HTTPS.
So the vault keeps its score on that browser, provided the URL rule holds.
Our Hermes Camofox verdict rates the browser plugin on its own terms.
📞 Want a straight answer on what to automate first? Book a free SEO strategy session and my team will look at your logins, jobs and tools with you. → Book the free call
Who Should Use The Hermes Vault
- Anyone whose agent signs into dashboards, portals or admin panels.
- Teams already on 1Password or Bitwarden, since those logins become fillable with no setup.
- Laptop users who want backups that can't open the vault, via keychain mode.
- People who buy things through an agent and want a hard approval step on every card.
Who Should Hold Off Or Change Defaults
- Anyone running unreviewed plugins who won't set
plugins.isolation: host. - Servers running overnight jobs, which should stay on the file key.
- Anyone who moves profiles between machines often and won't run
hermes vault key migrate --to filefirst. - Sites that only offer passkeys, where the agent will wait for you each time.
- Anyone who wants an agent to make purchases with no human in the loop, since card fills always ask.
Final Verdict
8.3 out of 10, and an easy recommendation for any Hermes user whose work sits behind logins.
The password-isolation design is the best part, and the keychain option is a real step up for a personal machine.
Keep the file key where nobody's logged in, and fence off plugins before saving anything important.
Want to set it up with live coaching? Join the AI Profit Boardroom.
Also On Our Network
- 🌐 The six-step setup order from first saved login to keychain key
- 🌐 How a shop, a service firm and an agency hand logins to an agent
- 🌐 Five copy-paste prompts that run the vault inside your Agent OS
- 🌐 Which AI models to pair with the vault, with live GoldieBench scores
- 🌐 The complete Hermes vault guide on the AI Profit Boardroom blog
FAQ: Hermes Vault Verdict
What is the weakest part of the Hermes vault?
Portability in keychain mode. Backups and copies no longer carry the key, so moving a profile needs hermes vault key migrate --to file first.
Is the keychain option better than the default file key?
On a personal laptop, yes: a copy of ~/.hermes gives ciphertext only. On servers that run jobs while logged out, the file key is the safer choice.
Can the Hermes vault work with KeePass?
Only through a password manager plugin from a verified vendor or official Nous catalog entry, and it stays off until you enable it for the profile.
Does a better AI model make the vault safer?
No. The password never enters the model's context through Hermes, so the protection is the same whichever model runs the session.
Did you benchmark the vault?
No. Every score here is an editorial rating built from the official docs and release notes.
📺 Video notes + links to the tools 👉
🎥 Learn how I make these videos 👉
🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉
About Julian
I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.
I help business owners scale with AI agents, automation and SEO.
- I've built a 7-figure SEO and link building agency, Goldie Agency, with a team of 70+ SEO experts.
- I've grown a YouTube channel to 400,000+ subscribers.
- I wrote "Link Building Mastery".
- My Udemy courses have taught over 29,000 students.
→ Get my best AI training inside the AI Profit Boardroom
Update to v0.22.6, run hermes vault key, and book a free strategy session if you want help deciding where the Hermes vault fits your stack.
