Stored at ~/.config/chip-fetcher/credentials.json (chmod 600 — only readable by your container user). chip-fetcher rewrites outbound URLs to https://user:pass@host/… so vendor portals like Component Search Engine never show a basic-auth popup.

Passwords are masked by default — click the dots to reveal or hide. The vault is plaintext on disk (vendor-portal creds aren't bank logins) but the UI keeps them off-screen so a casual screenshot doesn't leak them.