diff --git a/public/src/vault.js b/public/src/vault.js
index 7b83156..c08e1d2 100644
--- a/public/src/vault.js
+++ b/public/src/vault.js
@@ -156,7 +156,7 @@ const UncloseVault = {
   /**
    * Create session for auto-unlock persistence
    * Stores the password encrypted with a random session key
-   * Session persists indefinitely until explicitly locked
+   * Session is per-tab (sessionStorage): survives navigation, cleared on tab close
    */
   createSession(password) {
     if (!this.isAvailable()) return;
@@ -168,14 +168,14 @@ const UncloseVault = {
       // Encrypt password with session key
       const encryptedPassword = CryptoJS.AES.encrypt(password, sessionKey).toString();
 
-      // Store session data (no expiry - persists until locked)
+      // Store session data in sessionStorage (per-tab, survives navigation)
       const sessionData = {
         key: sessionKey,
         data: encryptedPassword,
         created: Date.now()
       };
 
-      localStorage.setItem(this.SESSION_KEY, JSON.stringify(sessionData));
+      sessionStorage.setItem(this.SESSION_KEY, JSON.stringify(sessionData));
     } catch (e) {
       console.error('Failed to create session:', e);
     }
@@ -184,14 +184,14 @@ const UncloseVault = {
   /**
    * Try to restore session (auto-unlock)
    * Returns true if session was valid and vault unlocked
-   * Sessions persist indefinitely until explicitly locked
+   * Session is per-tab: each new tab requires password, navigation within a tab does not
    */
   tryRestoreSession() {
     if (!this.isAvailable()) return false;
     if (this.isUnlocked()) return true; // Already unlocked
 
     try {
-      const sessionJson = localStorage.getItem(this.SESSION_KEY);
+      const sessionJson = sessionStorage.getItem(this.SESSION_KEY);
       if (!sessionJson) return false;
 
       const session = JSON.parse(sessionJson);
@@ -225,7 +225,7 @@ const UncloseVault = {
    * Clear session data
    */
   clearSession() {
-    localStorage.removeItem(this.SESSION_KEY);
+    sessionStorage.removeItem(this.SESSION_KEY);
   },
 
   /**
@@ -233,7 +233,7 @@ const UncloseVault = {
    */
   getSessionInfo() {
     try {
-      const sessionJson = localStorage.getItem(this.SESSION_KEY);
+      const sessionJson = sessionStorage.getItem(this.SESSION_KEY);
       if (!sessionJson) return null;
 
       const session = JSON.parse(sessionJson);