A method for authenticating a user to a third party website, characterized by: sending, from a vault system, executable code to a client device that, when executed by a processor at the client device, obfuscates an encryption key and stores the obfuscated encryption key at the client device, wherein the encryption key encrypts at least one website credential for authenticating the user to the third party website; receiving, at the vault system, the encrypted website credential from the client device, wherein the encryption key is not available to the vault system; storing the received encrypted website credential in a vault account at the vault system; receiving, from the client device, at least one first vault credential to authenticate the user with the vault account; authenticating the first vault credential; determining that the first vault credential is not authentic; requesting, in response to determining that the first vault credential is not authentic, at least one second vault credential to authenticate the user with the vault account, wherein the second vault credential is distinct from the first vault credential; authenticating the second vault credential; receiving, from the client device, a request for the encrypted website credential; retrieving the encrypted website credential from the vault account at the vault system; and sending, to the client device, the encrypted website credential and at least one form fill parameter in response to successfully authenticating the first vault credential and the second vault credential, wherein the executable code is further to: decrypt the encrypted website credential into the website credential using the stored obfuscated encryption key at the client device, and use the form fill parameter to inject the website credential into at least one form field (621, 623) in an authentication page of the third party website. sending, from a vault system, executable code to a client device that, when executed by a processor at the client device, obfuscates an encryption key and stores the obfuscated encryption key at the client device, wherein the encryption key encrypts at least one website credential for authenticating the user to the third party website; receiving, at the vault system, the encrypted website credential from the client device, wherein the encryption key is not available to the vault system; storing the received encrypted website credential in a vault account at the vault system; receiving, from the client device, at least one first vault credential to authenticate the user with the vault account; authenticating the first vault credential; determining that the first vault credential is not authentic; requesting, in response to determining that the first vault credential is not authentic, at least one second vault credential to authenticate the user with the vault account, wherein the second vault credential is distinct from the first vault credential; authenticating the second vault credential; receiving, from the client device, a request for the encrypted website credential; retrieving the encrypted website credential from the vault account at the vault system; and sending, to the client device, the encrypted website credential and at least one form fill parameter in response to successfully authenticating the first vault credential and the second vault credential, wherein the executable code is further to: decrypt the encrypted website credential into the website credential using the stored obfuscated encryption key at the client device, and use the form fill parameter to inject the website credential into at least one form field (621, 623) in an authentication page of the third party website. decrypt the encrypted website credential into the website credential using the stored obfuscated encryption key at the client device, and use the form fill parameter to inject the website credential into at least one form field (621, 623) in an authentication page of the third party website.