--- description: Migrate from Ionic Identity Vault to the Capacitor Vault plugin — a near drop-in replacement with biometric unlock, auto-lock, and multi-vault support. title: Alternative to the Ionic Identity Vault Plugin - Capawesome image: https://capawesome.io/docs/assets/images/social/blog/alternative-to-ionic-identity-vault-plugin.png --- [Skip to content ](#alternative-to-the-ionic-identity-vault-plugin) [🖥️ Introducing the **Capacitor Electron Platform** — build desktop apps for macOS, Windows, and Linux. Free & open source. ](/blog/announcing-the-capacitor-electron-platform/) * [ SDKs ](/docs/sdks/) * [ Formbricks ](/docs/sdks/capacitor/formbricks/) * [ Geocoder ](/docs/sdks/capacitor/geocoder/) * [ Google Sign-In ](/docs/sdks/capacitor/google-sign-in/) * [ Grafana Faro ](/docs/sdks/capacitor/grafana-faro/) * [ Gyroscope ](/docs/sdks/capacitor/gyroscope/) * [ Haptics ](/docs/sdks/capacitor/haptics/) * [ Home Indicator ](/docs/sdks/capacitor/home-indicator/) * [ In-App Browser ](/docs/sdks/capacitor/in-app-browser/) * [ Install Referrer ](/docs/sdks/capacitor/install-referrer/) * [ Intercom ](/docs/sdks/capacitor/intercom/) * [ Intune ](/docs/sdks/capacitor/intune/) * [ Keep Awake ](/docs/sdks/capacitor/keep-awake/) * [ libSQL ](/docs/sdks/capacitor/libsql/) * [ Light Sensor ](/docs/sdks/capacitor/light-sensor/) * [ Live Update ](/docs/sdks/capacitor/live-update/) * [ Localization ](/docs/sdks/capacitor/localization/) * [ Mail Composer ](/docs/sdks/capacitor/mail-composer/) * [ Managed Configurations ](/docs/sdks/capacitor/managed-configurations/) * [ Maps Launcher ](/docs/sdks/capacitor/maps-launcher/) * [ Media Session ](/docs/sdks/capacitor/media-session/) * [ ML Kit ](/docs/sdks/capacitor/mlkit/) * [ Navigation Bar ](/docs/sdks/capacitor/navigation-bar/) * [ Network ](/docs/sdks/capacitor/network/) * [ NFC ](/docs/sdks/capacitor/nfc/) * [ Node.js ](/docs/sdks/capacitor/nodejs/) * [ OAuth ](/docs/sdks/capacitor/oauth/) * [ Passkeys ](/docs/sdks/capacitor/passkeys/) * [ Password Autofill ](/docs/sdks/capacitor/password-autofill/) * [ PDF Generator ](/docs/sdks/capacitor/pdf-generator/) * [ PDF Viewer ](/docs/sdks/capacitor/pdf-viewer/) * [ Pedometer ](/docs/sdks/capacitor/pedometer/) * [ Permissions ](/docs/sdks/capacitor/permissions/) * [ Phone Dialer ](/docs/sdks/capacitor/phone-dialer/) * [ Photo Editor ](/docs/sdks/capacitor/photo-editor/) * [ Photo Manipulator ](/docs/sdks/capacitor/photo-manipulator/) * [ PixLive ](/docs/sdks/capacitor/pixlive/) * [ PostHog ](/docs/sdks/capacitor/posthog/) * [ Printer ](/docs/sdks/capacitor/printer/) * [ Privacy Screen ](/docs/sdks/capacitor/privacy-screen/) * [ Proximity Sensor ](/docs/sdks/capacitor/proximity-sensor/) * [ Purchases ](/docs/sdks/capacitor/purchases/) * [ RealtimeKit ](/docs/sdks/capacitor/realtimekit/) * [ Root Detection ](/docs/sdks/capacitor/root-detection/) * [ Screen Brightness ](/docs/sdks/capacitor/screen-brightness/) * [ Screen Orientation ](/docs/sdks/capacitor/screen-orientation/) * [ Screen Reader ](/docs/sdks/capacitor/screen-reader/) * [ Screenshot ](/docs/sdks/capacitor/screenshot/) * [ Secure Preferences ](/docs/sdks/capacitor/secure-preferences/) * [ Settings Launcher ](/docs/sdks/capacitor/settings-launcher/) * [ Shake ](/docs/sdks/capacitor/shake/) * [ Silent Mode ](/docs/sdks/capacitor/silent-mode/) * [ SIM ](/docs/sdks/capacitor/sim/) * [ SMS Composer ](/docs/sdks/capacitor/sms-composer/) * [ Speech Recognition ](/docs/sdks/capacitor/speech-recognition/) * [ Speech Synthesis ](/docs/sdks/capacitor/speech-synthesis/) * [ Share Target ](/docs/sdks/capacitor/share-target/) * [ Square Mobile Payments ](/docs/sdks/capacitor/square-mobile-payments/) * [ SQLite ](/docs/sdks/capacitor/sqlite/) * [ Superwall ](/docs/sdks/capacitor/superwall/) * [ System WebView ](/docs/sdks/capacitor/system-webview/) * [ Tauri ](/docs/sdks/capacitor/tauri/) * [ Text Interaction ](/docs/sdks/capacitor/text-interaction/) * [ Text Zoom ](/docs/sdks/capacitor/text-zoom/) * [ Thermal State ](/docs/sdks/capacitor/thermal-state/) * [ Toast ](/docs/sdks/capacitor/toast/) * [ Torch ](/docs/sdks/capacitor/torch/) * [ Vault ](/docs/sdks/capacitor/vault/) * [ Volume ](/docs/sdks/capacitor/volume/) * [ Wallet ](/docs/sdks/capacitor/wallet/) * [ Wifi ](/docs/sdks/capacitor/wifi/) * [ YouTube Player ](/docs/sdks/capacitor/youtube-player/) * [ Zip ](/docs/sdks/capacitor/zip/) * [ Cordova ](/docs/sdks/cordova/) * [ Cloud ](/docs/cloud/) * [ Integrations ](/docs/cloud/live-updates/integrations/) * Concepts * Reference * [ Troubleshooting ](/docs/cloud/live-updates/troubleshooting/) * [ FAQ ](/docs/cloud/live-updates/faq/) * [ Native Builds ](/docs/cloud/native-builds/) * [ Set Up Environments ](/docs/cloud/native-builds/environments/) * [ Overwrite Native Configurations ](/docs/cloud/native-builds/native-configurations/) * [ Auto-Increment Build Numbers ](/docs/cloud/native-builds/auto-incrementing-build-numbers/) * [ Configure the Web Build Script ](/docs/cloud/native-builds/web-build-script/) * [ Build from a Monorepo ](/docs/cloud/native-builds/monorepo/) * [ Use pnpm, Yarn, or bun ](/docs/cloud/native-builds/package-managers/) * [ Install Private npm Packages ](/docs/cloud/native-builds/npm-private-registry/) * [ Override the Java Version ](/docs/cloud/native-builds/override-java-version/) * [ Custom iOS Provisioning Profiles ](/docs/cloud/native-builds/custom-ios-provisioning-profiles/) * [ Build without Git ](/docs/cloud/native-builds/build-without-git/) * [ Access Git Behind a Firewall ](/docs/cloud/native-builds/firewall-access/) * [ Integrations ](/docs/cloud/native-builds/integrations/) * Reference * [ Troubleshooting ](/docs/cloud/native-builds/troubleshooting/) * [ FAQ ](/docs/cloud/native-builds/faq/) * [ App Store Publishing ](/docs/cloud/app-store-publishing/) * [ Submit a Build ](/docs/cloud/app-store-publishing/submit-a-build/) * [ Submit Automatically After a Build ](/docs/cloud/app-store-publishing/submit-automatically/) * [ Troubleshooting ](/docs/cloud/app-store-publishing/troubleshooting/) * [ FAQ ](/docs/cloud/app-store-publishing/faq/) * [ Automations ](/docs/cloud/automations/) * [ Reference ](/docs/cloud/automations/reference/) * [ Troubleshooting ](/docs/cloud/automations/troubleshooting/) * [ FAQ ](/docs/cloud/automations/faq/) * [ Assist ](/docs/cloud/assist/) * [ CLI ](/docs/cloud/cli/) * APIs and SDKs * [ Webhooks ](/docs/cloud/webhooks/) * [ Integrations ](/docs/cloud/integrations/) * Account * [ Organization ](/docs/cloud/organizations/) * [ Two-Factor Enforcement ](/docs/cloud/organizations/two-factor-authentication/) * [ Audit Logs ](/docs/cloud/organizations/audit-logs/) * [ Billing ](/docs/cloud/organizations/billing/) * [ License Keys ](/docs/cloud/license-keys/) * [ AI ](/docs/ai/) * [ Insiders ](/docs/insiders/) * [ Billing & Plans ](/docs/insiders/billing-and-plans/) * [ FAQ ](/docs/insiders/faq/) * [ License ](https://capawesome.io/legal/eula/) * [ Support ](/docs/support/) * [ Contributing ](/docs/contributing/) * Contributing code * [ Code of Conduct ](/docs/contributing/code-of-conduct/) * [ Questions ](https://docs.github.com/en/discussions/collaborating-with-your-community-using-discussions/participating-in-a-discussion#creating-a-discussion) * [ Blog ](/blog/) * Categories * [ FAQ ](#faq) * [ Need Help Migrating? ](#need-help-migrating) * [ Conclusion ](#conclusion) * Related links # Alternative to the Ionic Identity Vault Plugin[¶](#alternative-to-the-ionic-identity-vault-plugin "Permanent link") Looking for a way to protect sensitive data and authenticate users in your Capacitor app? With [Ionic discontinuing](https://ionic.io/blog/important-announcement-the-future-of-ionics-commercial-products) their commercial Identity Vault plugin, developers need a reliable alternative for **biometric authentication** (Face ID, fingerprint) and secure session management. The [Capacitor Vault plugin](/docs/sdks/capacitor/vault/) from Capawesome is a near drop-in replacement — same active lock pattern, the same method names for the core operations, multi-vault support out of the box, and no enterprise subscription required. For background on the plugin, see our [announcement post](/blog/announcing-the-capacitor-vault-plugin/). [ ![Build and deploy your Capacitor app with Capawesome Cloud](https://capawesome.io/assets/banners/cloud-build-and-deploy-capacitor-apps.png?t=1) ](/) ## Key Takeaways[¶](#key-takeaways "Permanent link") * The [Capacitor Vault plugin](/docs/sdks/capacitor/vault/) is a near drop-in replacement for Ionic Identity Vault — no enterprise subscription required. * Core operations (`unlock`, `lock`, `setValue`, `getValue`, `removeValue`, `clear`) keep the same method names; most calls switch from positional arguments to an options object. * The constructor `new Vault(config)` becomes a single static `initialize(...)` call, and `type` \+ `deviceSecurityType` collapse into one `VaultType` enum. * Multi-vault support is built in via the `vaultId` option on every method. * Stored data can't be copied across directly — migrate it at runtime while both plugins are installed, using Identity Vault's `exportVault()` and the Capacitor Vault plugin's `importData(...)`. ## Introduction[¶](#introduction "Permanent link") Ionic Identity Vault combined biometric authentication, encrypted storage, and session management into a single plugin. It let developers store tokens and credentials securely, lock and unlock a vault with Face ID or fingerprint, and automatically clear sensitive data after inactivity. Following Ionic's decision to phase out their commercial products, teams need a replacement. The [Capacitor Vault plugin](/docs/sdks/capacitor/vault/) from Capawesome was built for exactly this scenario. It covers the same surface — biometric or device-passcode unlock, a session-based lock model with auto-lock, hardware-backed key/value storage, and migration utilities — under an API that mirrors Identity Vault's most common methods. In most cases, migrating is a matter of swapping the import and adding a one-time `initialize(...)` call. ## Feature Comparison[¶](#feature-comparison "Permanent link") Here's a side-by-side look at how Identity Vault features map to the Capacitor Vault plugin: | Feature | Identity Vault | Capacitor Vault | | -------------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------ | | Initialize vault | new Vault(config) | [Vault.initialize(...)](/docs/sdks/capacitor/vault/#initialize) | | Biometric unlock | Vault.unlock() | [Vault.unlock()](/docs/sdks/capacitor/vault/#unlock) | | Lock vault | Vault.lock() | [Vault.lock()](/docs/sdks/capacitor/vault/#lock) | | Check if locked | Vault.isLocked() | [Vault.isLocked()](/docs/sdks/capacitor/vault/#islocked) | | Store values | Vault.setValue(...) | [Vault.setValue(...)](/docs/sdks/capacitor/vault/#setvalue) | | Retrieve values | Vault.getValue(...) | [Vault.getValue(...)](/docs/sdks/capacitor/vault/#getvalue) | | Remove values | Vault.removeValue(...) | [Vault.removeValue(...)](/docs/sdks/capacitor/vault/#removevalue) | | List keys | Vault.getKeys() | [Vault.getKeys()](/docs/sdks/capacitor/vault/#getkeys) | | Clear all data | Vault.clear() | [Vault.clear()](/docs/sdks/capacitor/vault/#clear) | | Device credential fallback | DeviceSecurityType.Both | VaultType.BiometricOrDevicePasscode / VaultType.DevicePasscode | | Auto-lock on background | lockAfterBackgrounded | lockAfterBackgrounded | | Lock / unlock events | onLock / onUnlock callbacks | [addListener('lock', ...)](/docs/sdks/capacitor/vault/#addlistenerlock-) | | Multiple vaults | Multiple Vault instances | vaultId option on every method | | Key invalidation | Built-in | invalidateOnBiometricEnrollment | | Export / import data | Manual | [exportData()](/docs/sdks/capacitor/vault/#exportdata) / [importData(...)](/docs/sdks/capacitor/vault/#importdata) | | Web fallback | Built-in | localStorage (dev only) | Identity Vault's most common methods carry their names over to the Capacitor Vault plugin, so a typical migration touches the import statement, the constructor (now `initialize(...)`), and a few configuration option names. AI-Assisted Migration For a more guided experience, add the [Capawesome skills](https://github.com/capawesome-team/skills) to your project with `npx skills add capawesome-team/skills --skill ionic-enterprise-sdk-migration` and use the following prompt with your preferred AI coding assistant: `` [](#%5F%5Fcodelineno-0-1)Use the `ionic-enterprise-sdk-migration` skill from `capawesome-team/skills` to help me migrate from Ionic Identity Vault to the Capacitor Vault plugin. `` ## Migration from Identity Vault[¶](#migration-from-identity-vault "Permanent link") Migrating from Identity Vault is largely a matter of swapping the constructor for an `initialize(...)` call and updating the import path. The following sections walk through the most common scenarios. ### Installation[¶](#installation "Permanent link") Begin by removing the existing Identity Vault dependency and installing the Capacitor Vault plugin. To install the [Capacitor Vault plugin](/docs/sdks/capacitor/vault/), please refer to the [Installation](/docs/sdks/capacitor/vault/#installation) section in the plugin documentation. ### Initializing the Vault[¶](#initializing-the-vault "Permanent link") Identity Vault uses a `new Vault(config)` constructor for each vault instance. The Capacitor Vault plugin uses a static [initialize(...)](/docs/sdks/capacitor/vault/#initialize) call that takes the same shape of configuration. **Identity Vault:** `[](#%5F%5Fcodelineno-1-1)import { Vault, DeviceSecurityType, VaultType } from '@ionic-enterprise/identity-vault'; [](#%5F%5Fcodelineno-1-2) [](#%5F%5Fcodelineno-1-3)const vault = new Vault({ [](#%5F%5Fcodelineno-1-4) key: 'com.example.vault', [](#%5F%5Fcodelineno-1-5) type: VaultType.DeviceSecurity, [](#%5F%5Fcodelineno-1-6) deviceSecurityType: DeviceSecurityType.Both, [](#%5F%5Fcodelineno-1-7) lockAfterBackgrounded: 2000, [](#%5F%5Fcodelineno-1-8)}); ` **Capacitor Vault:** `[](#%5F%5Fcodelineno-2-1)import { Vault, VaultType } from '@capawesome-team/capacitor-vault'; [](#%5F%5Fcodelineno-2-2) [](#%5F%5Fcodelineno-2-3)const initialize = async () => { [](#%5F%5Fcodelineno-2-4) await Vault.initialize({ [](#%5F%5Fcodelineno-2-5) vaultId: 'com.example.vault', [](#%5F%5Fcodelineno-2-6) type: VaultType.BiometricOrDevicePasscode, [](#%5F%5Fcodelineno-2-7) lockAfterBackgrounded: 2000, [](#%5F%5Fcodelineno-2-8) }); [](#%5F%5Fcodelineno-2-9)}; ` Call `initialize(...)` once per session before any other method. The `vaultId` option corresponds to Identity Vault's `key`, and `type` collapses Identity Vault's separate `type` and `deviceSecurityType` into a single enum (`Biometric`, `BiometricOrDevicePasscode`, or `DevicePasscode`). ### Biometric Authentication[¶](#biometric-authentication "Permanent link") Identity Vault uses `vault.unlock()` to trigger biometric authentication. The Capacitor Vault plugin uses the same method name — only the import changes. **Identity Vault:** `[](#%5F%5Fcodelineno-3-1)const unlock = async () => { [](#%5F%5Fcodelineno-3-2) await vault.unlock(); [](#%5F%5Fcodelineno-3-3)}; ` **Capacitor Vault:** `[](#%5F%5Fcodelineno-4-1)import { Vault, ErrorCode } from '@capawesome-team/capacitor-vault'; [](#%5F%5Fcodelineno-4-2) [](#%5F%5Fcodelineno-4-3)const unlock = async () => { [](#%5F%5Fcodelineno-4-4) try { [](#%5F%5Fcodelineno-4-5) await Vault.unlock(); [](#%5F%5Fcodelineno-4-6) } catch (error) { [](#%5F%5Fcodelineno-4-7) if (error.code === ErrorCode.UnlockCanceled) { [](#%5F%5Fcodelineno-4-8) // User dismissed the prompt [](#%5F%5Fcodelineno-4-9) } else if (error.code === ErrorCode.KeyInvalidated) { [](#%5F%5Fcodelineno-4-10) // Biometric set changed — re-enrollment required [](#%5F%5Fcodelineno-4-11) } else { [](#%5F%5Fcodelineno-4-12) throw error; [](#%5F%5Fcodelineno-4-13) } [](#%5F%5Fcodelineno-4-14) } [](#%5F%5Fcodelineno-4-15)}; ` Typed error codes let you branch on the specific reason an unlock failed instead of catching a generic error. `UnlockCanceled` means the user dismissed the prompt; `KeyInvalidated` means the device's biometric set has changed and the vault needs to be reinitialized. ### Storing Values[¶](#storing-values "Permanent link") Identity Vault's `setValue(...)` stores data inside the encrypted vault. The Capacitor Vault plugin uses the same method name with an options-object argument. **Identity Vault:** `[](#%5F%5Fcodelineno-5-1)const storeToken = async () => { [](#%5F%5Fcodelineno-5-2) await vault.setValue('session_token', 'eyJhbGciOiJIUzI1NiIs...'); [](#%5F%5Fcodelineno-5-3)}; ` **Capacitor Vault:** `[](#%5F%5Fcodelineno-6-1)import { Vault } from '@capawesome-team/capacitor-vault'; [](#%5F%5Fcodelineno-6-2) [](#%5F%5Fcodelineno-6-3)const storeToken = async () => { [](#%5F%5Fcodelineno-6-4) await Vault.setValue({ [](#%5F%5Fcodelineno-6-5) key: 'session_token', [](#%5F%5Fcodelineno-6-6) value: 'eyJhbGciOiJIUzI1NiIs...', [](#%5F%5Fcodelineno-6-7) }); [](#%5F%5Fcodelineno-6-8)}; ` ### Retrieving Values[¶](#retrieving-values "Permanent link") Reading a value follows the same pattern — positional arguments become an options object. **Identity Vault:** `[](#%5F%5Fcodelineno-7-1)const getToken = async () => { [](#%5F%5Fcodelineno-7-2) const token = await vault.getValue('session_token'); [](#%5F%5Fcodelineno-7-3) return token; [](#%5F%5Fcodelineno-7-4)}; ` **Capacitor Vault:** `[](#%5F%5Fcodelineno-8-1)import { Vault } from '@capawesome-team/capacitor-vault'; [](#%5F%5Fcodelineno-8-2) [](#%5F%5Fcodelineno-8-3)const getToken = async () => { [](#%5F%5Fcodelineno-8-4) const { value } = await Vault.getValue({ key: 'session_token' }); [](#%5F%5Fcodelineno-8-5) return value; [](#%5F%5Fcodelineno-8-6)}; ` ### Removing Values[¶](#removing-values "Permanent link") Removing a single value uses the same `removeValue` method name in both plugins. **Identity Vault:** `[](#%5F%5Fcodelineno-9-1)const removeToken = async () => { [](#%5F%5Fcodelineno-9-2) await vault.removeValue('session_token'); [](#%5F%5Fcodelineno-9-3)}; ` **Capacitor Vault:** `[](#%5F%5Fcodelineno-10-1)import { Vault } from '@capawesome-team/capacitor-vault'; [](#%5F%5Fcodelineno-10-2) [](#%5F%5Fcodelineno-10-3)const removeToken = async () => { [](#%5F%5Fcodelineno-10-4) await Vault.removeValue({ key: 'session_token' }); [](#%5F%5Fcodelineno-10-5)}; ` ### Clearing All Data[¶](#clearing-all-data "Permanent link") `clear()` empties the vault while preserving its configuration. **Identity Vault:** `[](#%5F%5Fcodelineno-11-1)const clearVault = async () => { [](#%5F%5Fcodelineno-11-2) await vault.clear(); [](#%5F%5Fcodelineno-11-3)}; ` **Capacitor Vault:** `[](#%5F%5Fcodelineno-12-1)import { Vault } from '@capawesome-team/capacitor-vault'; [](#%5F%5Fcodelineno-12-2) [](#%5F%5Fcodelineno-12-3)const clearAll = async () => { [](#%5F%5Fcodelineno-12-4) await Vault.clear(); [](#%5F%5Fcodelineno-12-5)}; ` ### Session Management[¶](#session-management "Permanent link") Identity Vault's `lockAfterBackgrounded` option ports over directly to the Capacitor Vault plugin — set it during `initialize(...)` and the vault locks itself when the app has been backgrounded for that long. Lock and unlock callbacks are exposed as events: `` [](#%5F%5Fcodelineno-13-1)import { Vault } from '@capawesome-team/capacitor-vault'; [](#%5F%5Fcodelineno-13-2) [](#%5F%5Fcodelineno-13-3)const setupSessionHandling = async () => { [](#%5F%5Fcodelineno-13-4) await Vault.addListener('lock', ({ vaultId, trigger }) => { [](#%5F%5Fcodelineno-13-5) // trigger is 'MANUAL' or 'TIMEOUT' [](#%5F%5Fcodelineno-13-6) console.log(`Vault ${vaultId} locked (trigger: ${trigger}).`); [](#%5F%5Fcodelineno-13-7) }); [](#%5F%5Fcodelineno-13-8) await Vault.addListener('unlock', ({ vaultId }) => { [](#%5F%5Fcodelineno-13-9) console.log(`Vault ${vaultId} unlocked.`); [](#%5F%5Fcodelineno-13-10) }); [](#%5F%5Fcodelineno-13-11)}; `` The `trigger` on the lock event tells you whether the vault was locked by an explicit `lock()` call (`MANUAL`) or by the auto-lock timer (`TIMEOUT`) — useful when the two cases warrant different UI feedback. ### Multiple Vaults[¶](#multiple-vaults "Permanent link") Identity Vault supports multiple vaults via multiple `Vault` instances. The Capacitor Vault plugin supports the same through the `vaultId` option, which every method accepts: `[](#%5F%5Fcodelineno-14-1)import { Vault, VaultType } from '@capawesome-team/capacitor-vault'; [](#%5F%5Fcodelineno-14-2) [](#%5F%5Fcodelineno-14-3)const initializeBoth = async () => { [](#%5F%5Fcodelineno-14-4) await Vault.initialize({ [](#%5F%5Fcodelineno-14-5) vaultId: 'user-tokens', [](#%5F%5Fcodelineno-14-6) type: VaultType.Biometric, [](#%5F%5Fcodelineno-14-7) }); [](#%5F%5Fcodelineno-14-8) await Vault.initialize({ [](#%5F%5Fcodelineno-14-9) vaultId: 'app-settings', [](#%5F%5Fcodelineno-14-10) type: VaultType.BiometricOrDevicePasscode, [](#%5F%5Fcodelineno-14-11) lockAfterBackgrounded: 60000, [](#%5F%5Fcodelineno-14-12) }); [](#%5F%5Fcodelineno-14-13)}; ` Each vault keeps its own keys, lock state, and configuration — handy for multi-account apps or for separating data with different sensitivity levels. ### Migrating Stored Data[¶](#migrating-stored-data "Permanent link") If your app already has data in an Identity Vault, you cannot move it across by reusing Identity Vault's keystore or keychain entries. The two plugins use incompatible storage formats — Identity Vault keeps the whole vault as a single encrypted blob (on Android partly via a closed-source dependency), while the Capacitor Vault plugin stores each value individually with its own encryption scheme. There is no way to decrypt Identity Vault's data without its proprietary implementation. Instead, migrate the data at runtime while **both** plugins are still installed. Identity Vault's `exportVault()` returns a plain key/value map after the vault is unlocked, and that map has the exact shape the Capacitor Vault plugin's [importData(...)](/docs/sdks/capacitor/vault/#importdata) method expects, so you can bridge the two directly: `[](#%5F%5Fcodelineno-15-1)import { Vault, VaultType } from '@capawesome-team/capacitor-vault'; [](#%5F%5Fcodelineno-15-2)// Your existing Identity Vault instance. [](#%5F%5Fcodelineno-15-3)import { vault as identityVault } from './identity-vault'; [](#%5F%5Fcodelineno-15-4) [](#%5F%5Fcodelineno-15-5)const MIGRATION_KEY = 'capacitor-vault-migrated'; [](#%5F%5Fcodelineno-15-6) [](#%5F%5Fcodelineno-15-7)const migrateFromIdentityVault = async () => { [](#%5F%5Fcodelineno-15-8) // Skip if the migration has already been performed. [](#%5F%5Fcodelineno-15-9) if (localStorage.getItem(MIGRATION_KEY)) { [](#%5F%5Fcodelineno-15-10) return; [](#%5F%5Fcodelineno-15-11) } [](#%5F%5Fcodelineno-15-12) // Nothing to migrate if the old vault is empty. [](#%5F%5Fcodelineno-15-13) if (await identityVault.isEmpty()) { [](#%5F%5Fcodelineno-15-14) localStorage.setItem(MIGRATION_KEY, 'true'); [](#%5F%5Fcodelineno-15-15) return; [](#%5F%5Fcodelineno-15-16) } [](#%5F%5Fcodelineno-15-17) [](#%5F%5Fcodelineno-15-18) // Unlocking prompts the user to authenticate (e.g. via biometrics). [](#%5F%5Fcodelineno-15-19) await identityVault.unlock(); [](#%5F%5Fcodelineno-15-20) const data = await identityVault.exportVault(); [](#%5F%5Fcodelineno-15-21) [](#%5F%5Fcodelineno-15-22) // Initialize the new vault and import the data. [](#%5F%5Fcodelineno-15-23) await Vault.initialize({ type: VaultType.Biometric }); [](#%5F%5Fcodelineno-15-24) await Vault.unlock(); [](#%5F%5Fcodelineno-15-25) await Vault.importData({ data }); [](#%5F%5Fcodelineno-15-26) [](#%5F%5Fcodelineno-15-27) // Clear the old vault and mark the migration as complete. [](#%5F%5Fcodelineno-15-28) await identityVault.clear(); [](#%5F%5Fcodelineno-15-29) localStorage.setItem(MIGRATION_KEY, 'true'); [](#%5F%5Fcodelineno-15-30)}; ` Run this once before removing the Identity Vault dependency. The user has to authenticate a single time to unlock the old vault — this is unavoidable, since the data is protected by the device's biometric or passcode authentication by design. Once all users have migrated (for example, after a release cycle in which everyone has opened the app at least once), you can drop Identity Vault in a follow-up release. ## FAQ[¶](#faq "Permanent link") ### Is the Capacitor Vault plugin free, since it doesn't need an Ionic enterprise subscription?[¶](#is-the-capacitor-vault-plugin-free-since-it-doesnt-need-an-ionic-enterprise-subscription "Permanent link") It doesn't require Ionic Identity Vault's enterprise subscription, but it's still a paid plugin — part of [Capawesome Insiders](https://capawesome.io/insiders/). The difference is licensing model, not price point: no per-seat enterprise contract, just a Capawesome Insiders subscription that covers this plugin alongside the rest of the catalog. ### What happens if a user's biometrics change after enrollment?[¶](#what-happens-if-a-users-biometrics-change-after-enrollment "Permanent link") The Capacitor Vault plugin can invalidate the vault's key automatically when the device's enrolled biometrics change (fingerprint added/removed, new face enrolled) via the `invalidateOnBiometricEnrollment` option. When that happens, `unlock()` rejects with `ErrorCode.KeyInvalidated`, telling your app to prompt the user to reinitialize the vault rather than silently failing. ### Does the plugin support falling back to a device passcode if biometrics aren't available?[¶](#does-the-plugin-support-falling-back-to-a-device-passcode-if-biometrics-arent-available "Permanent link") Yes, via `VaultType.BiometricOrDevicePasscode` — the same behavior as Identity Vault's `DeviceSecurityType.Both`. Use `VaultType.DevicePasscode` if you want to skip biometrics entirely and only accept the device passcode. ### Can I run multiple vaults with different lock timeouts in the same app?[¶](#can-i-run-multiple-vaults-with-different-lock-timeouts-in-the-same-app "Permanent link") Yes. Every method takes a `vaultId` option, so a multi-account app (or one that separates high-sensitivity data like payment tokens from lower-sensitivity settings) can initialize several vaults, each with its own `lockAfterBackgrounded` timeout and lock state. ### Can I migrate existing vault data without asking users to re-authenticate?[¶](#can-i-migrate-existing-vault-data-without-asking-users-to-re-authenticate "Permanent link") No — this one step is unavoidable. The old vault's contents are protected by the device's biometric or passcode authentication by design, so reading them via `exportVault()` requires unlocking the Identity Vault instance first. Users authenticate once during the migration, and everything after that uses the new vault normally. ## Need Help Migrating?[¶](#need-help-migrating "Permanent link") If you'd rather not handle the migration yourself, the Capawesome team can take care of it for you. Whether you're dealing with a straightforward swap or a more complex setup with custom session management, we offer dedicated migration services to get you up and running with minimal downtime and effort on your end. [Book a Free Consultation](https://cal.com/team/capawesome/ionic-appflow-migration) ## Conclusion[¶](#conclusion "Permanent link") The discontinuation of Ionic Identity Vault doesn't have to disrupt your workflow. The [Capacitor Vault plugin](/docs/sdks/capacitor/vault/) gives you a near drop-in replacement with the same active lock pattern, the same core method names, and first-class multi-vault support — without the enterprise subscription. For the full plugin documentation, see the [API Reference](/docs/sdks/capacitor/vault/#api). **Related reading:** * [Announcing the Capacitor Vault Plugin](/blog/announcing-the-capacitor-vault-plugin/) * [Alternatives to Ionic Enterprise Plugins](/blog/alternatives-to-ionic-enterprise-plugins/) * [How to Securely Store Credentials with Capacitor](/blog/how-to-securely-store-credentials-with-capacitor/) **Stay updated:** Have questions or want to share your migration experience? Join the [Capawesome Discord server](https://discord.gg/VCXxSVjefW) to connect with the community. To stay updated with the latest updates, features, and news about Capawesome, Capacitor, and the Ionic ecosystem, subscribe to our [Capawesome newsletter](/newsletter/). **Need help migrating from Identity Vault?** [Contact us](mailto:support@capawesome.io) to get started. July 17, 2026 Back to top ```json { "@context": "https://schema.org", "@type": "BlogPosting", "headline": "Alternative to the Ionic Identity Vault Plugin", "description": "Migrate from Ionic Identity Vault to the Capacitor Vault plugin \u2014 a near drop-in replacement with biometric unlock, auto-lock, and multi-vault support.", "image": "https://capawesome.io/assets/banners/cloud-build-and-deploy-capacitor-apps.png", "datePublished": "2026-02-09T00:00:00+00:00", "dateModified": "2026-07-17T00:00:00+00:00", "author": [ { "@type": "Person", "name": "Robin Genz", "url": "https://github.com/robingenz" } ], "publisher": { "@type": "Organization", "name": "Capawesome", "url": "https://capawesome.io", "logo": { "@type": "ImageObject", "url": "https://capawesome.io/assets/images/logo.svg" } }, "articleSection": "Capacitor", "keywords": ["Capacitor", "Guides", "SDKs"], "isPartOf": { "@type": "Blog", "@id": "https://capawesome.io/blog/#blog" }, "mainEntityOfPage": "https://capawesome.io/blog/alternative-to-ionic-identity-vault-plugin/", "url": "https://capawesome.io/blog/alternative-to-ionic-identity-vault-plugin/" } { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://capawesome.io/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://capawesome.io/blog/" }, { "@type": "ListItem", "position": 3, "name": "Alternative to the Ionic Identity Vault Plugin", "item": "https://capawesome.io/blog/alternative-to-ionic-identity-vault-plugin/" } ] } {"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "Is the Capacitor Vault plugin free, since it doesn't need an Ionic enterprise subscription?", "acceptedAnswer": {"@type": "Answer", "text": "It doesn't require Ionic Identity Vault's enterprise subscription, but it's still a paid plugin — part of Capawesome Insiders. The difference is licensing model, not price point: no per-seat enterprise contract, just a Capawesome Insiders subscription that covers this plugin alongside the rest of the catalog."}}, {"@type": "Question", "name": "What happens if a user's biometrics change after enrollment?", "acceptedAnswer": {"@type": "Answer", "text": "The Capacitor Vault plugin can invalidate the vault's key automatically when the device's enrolled biometrics change (fingerprint added/removed, new face enrolled) via the invalidateOnBiometricEnrollment option. When that happens, unlock() rejects with ErrorCode.KeyInvalidated, telling your app to prompt the user to reinitialize the vault rather than silently failing."}}, {"@type": "Question", "name": "Does the plugin support falling back to a device passcode if biometrics aren't available?", "acceptedAnswer": {"@type": "Answer", "text": "Yes, via VaultType.BiometricOrDevicePasscode — the same behavior as Identity Vault's DeviceSecurityType.Both. Use VaultType.DevicePasscode if you want to skip biometrics entirely and only accept the device passcode."}}, {"@type": "Question", "name": "Can I run multiple vaults with different lock timeouts in the same app?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. Every method takes a vaultId option, so a multi-account app (or one that separates high-sensitivity data like payment tokens from lower-sensitivity settings) can initialize several vaults, each with its own lockAfterBackgrounded timeout and lock state."}}, {"@type": "Question", "name": "Can I migrate existing vault data without asking users to re-authenticate?", "acceptedAnswer": {"@type": "Answer", "text": "No — this one step is unavoidable. The old vault's contents are protected by the device's biometric or passcode authentication by design, so reading them via exportVault() requires unlocking the Identity Vault instance first. Users authenticate once during the migration, and everything after that uses the new vault normally."}}, {"@type": "Question", "name": "Need Help Migrating?", "acceptedAnswer": {"@type": "Answer", "text": "If you'd rather not handle the migration yourself, the Capawesome team can take care of it for you. Whether you're dealing with a straightforward swap or a more complex setup with custom session management, we offer dedicated migration services to get you up and running with minimal downtime and effort on your end. Book a Free Consultation"}}], "url": "https://capawesome.io/blog/alternative-to-ionic-identity-vault-plugin/"} ```