diff --git a/internal/secrets/secrets_test.go b/internal/secrets/secrets_test.go
new file mode 100644
index 0000000..6ce9b96
--- /dev/null
+++ b/internal/secrets/secrets_test.go
@@ -0,0 +1,511 @@
+package secrets
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+// ---------------------------------------------------------------------------
+// Full lifecycle: init → set → get → lock → fail → unlock → get
+// ---------------------------------------------------------------------------
+
+func TestSecretStoreLifecycle(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+
+	if store.IsInitialised() {
+		t.Fatal("expected vault to be uninitialised on a fresh directory")
+	}
+
+	// Initialise with a master password.
+	if err := store.Initialise("correct-horse-battery-staple"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+	if !store.IsInitialised() {
+		t.Fatal("expected vault to be initialised after Initialise()")
+	}
+	if !store.IsUnlocked() {
+		t.Fatal("expected vault to be unlocked after Initialise()")
+	}
+
+	// Store a secret and retrieve it.
+	if err := store.SetSecret("profile:abc:password", "s3cret"); err != nil {
+		t.Fatalf("SetSecret() error = %v", err)
+	}
+	val, err := store.GetSecret("profile:abc:password")
+	if err != nil {
+		t.Fatalf("GetSecret() error = %v", err)
+	}
+	if val != "s3cret" {
+		t.Errorf("GetSecret() = %q, want %q", val, "s3cret")
+	}
+
+	// Lock the vault — should prevent reads.
+	store.Lock()
+	if store.IsUnlocked() {
+		t.Fatal("expected vault to be locked after Lock()")
+	}
+	if _, err := store.GetSecret("profile:abc:password"); err == nil {
+		t.Fatal("expected error when getting secret from locked vault")
+	}
+
+	// Unlock and read again.
+	if err := store.Unlock("correct-horse-battery-staple"); err != nil {
+		t.Fatalf("Unlock() error = %v", err)
+	}
+	val, err = store.GetSecret("profile:abc:password")
+	if err != nil {
+		t.Fatalf("GetSecret() after unlock error = %v", err)
+	}
+	if val != "s3cret" {
+		t.Errorf("GetSecret() after unlock = %q, want %q", val, "s3cret")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Wrong password should fail to unlock
+// ---------------------------------------------------------------------------
+
+func TestSecretStoreWrongPassword(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+
+	if err := store.Initialise("passwordA"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+	// Store a secret so the password verification has something to decrypt.
+	if err := store.SetSecret("test:key", "value"); err != nil {
+		t.Fatalf("SetSecret() error = %v", err)
+	}
+	store.Lock()
+
+	if err := store.Unlock("passwordB"); err == nil {
+		t.Fatal("expected error when unlocking with wrong password")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Multiple secrets — store, retrieve, delete selectively
+// ---------------------------------------------------------------------------
+
+func TestSecretStoreMultipleSecrets(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+
+	if err := store.Initialise("master"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+
+	secrets := map[string]string{
+		"profile:a:password":   "alpha",
+		"profile:b:password":   "bravo",
+		"profile:c:passphrase": "charlie",
+	}
+	for k, v := range secrets {
+		if err := store.SetSecret(k, v); err != nil {
+			t.Fatalf("SetSecret(%q) error = %v", k, err)
+		}
+	}
+
+	// Verify each secret.
+	for k, want := range secrets {
+		got, err := store.GetSecret(k)
+		if err != nil {
+			t.Fatalf("GetSecret(%q) error = %v", k, err)
+		}
+		if got != want {
+			t.Errorf("GetSecret(%q) = %q, want %q", k, got, want)
+		}
+	}
+
+	// Delete one secret and verify the others remain.
+	if err := store.DeleteSecret("profile:b:password"); err != nil {
+		t.Fatalf("DeleteSecret() error = %v", err)
+	}
+	if _, err := store.GetSecret("profile:b:password"); err == nil {
+		t.Error("expected error when getting deleted secret")
+	}
+	for _, key := range []string{"profile:a:password", "profile:c:passphrase"} {
+		if _, err := store.GetSecret(key); err != nil {
+			t.Errorf("GetSecret(%q) should still work after unrelated delete, got %v", key, err)
+		}
+	}
+}
+
+// ---------------------------------------------------------------------------
+// DeleteProfileSecrets
+// ---------------------------------------------------------------------------
+
+func TestDeleteProfileSecrets(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+
+	if err := store.Initialise("master"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+
+	// Store secrets for two profiles.
+	if err := store.SetSecret("profile:p1:password", "pw1"); err != nil {
+		t.Fatalf("SetSecret() error = %v", err)
+	}
+	if err := store.SetSecret("profile:p1:passphrase", "pp1"); err != nil {
+		t.Fatalf("SetSecret() error = %v", err)
+	}
+	if err := store.SetSecret("profile:p2:password", "pw2"); err != nil {
+		t.Fatalf("SetSecret() error = %v", err)
+	}
+
+	// Delete profile p1's secrets.
+	if err := store.DeleteProfileSecrets("p1"); err != nil {
+		t.Fatalf("DeleteProfileSecrets() error = %v", err)
+	}
+
+	// p1 secrets should be gone.
+	if _, err := store.GetSecret("profile:p1:password"); err == nil {
+		t.Error("expected p1 password to be deleted")
+	}
+	if _, err := store.GetSecret("profile:p1:passphrase"); err == nil {
+		t.Error("expected p1 passphrase to be deleted")
+	}
+
+	// p2 secret should remain.
+	val, err := store.GetSecret("profile:p2:password")
+	if err != nil {
+		t.Fatalf("GetSecret(p2) error = %v", err)
+	}
+	if val != "pw2" {
+		t.Errorf("GetSecret(p2) = %q, want %q", val, "pw2")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Reinitialise an existing vault should fail
+// ---------------------------------------------------------------------------
+
+func TestSecretStoreDoubleInitialise(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+
+	if err := store.Initialise("pw"); err != nil {
+		t.Fatalf("first Initialise() error = %v", err)
+	}
+	if err := store.Initialise("pw"); err == nil {
+		t.Fatal("expected error on second Initialise()")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Persistence across store instances
+// ---------------------------------------------------------------------------
+
+func TestSecretStorePersistence(t *testing.T) {
+	dir := t.TempDir()
+
+	// Instance 1: create and store.
+	s1 := NewSecretStore(dir)
+	if err := s1.Initialise("master"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+	if err := s1.SetSecret("k", "v"); err != nil {
+		t.Fatalf("SetSecret() error = %v", err)
+	}
+	s1.Lock()
+
+	// Instance 2: open the same directory and unlock.
+	s2 := NewSecretStore(dir)
+	if !s2.IsInitialised() {
+		t.Fatal("expected vault to be initialised from disc")
+	}
+	if err := s2.Unlock("master"); err != nil {
+		t.Fatalf("Unlock() on second instance error = %v", err)
+	}
+	val, err := s2.GetSecret("k")
+	if err != nil {
+		t.Fatalf("GetSecret() on second instance error = %v", err)
+	}
+	if val != "v" {
+		t.Errorf("got %q, want %q", val, "v")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// ListKeys
+// ---------------------------------------------------------------------------
+
+func TestListKeys(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+
+	if err := store.Initialise("master"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+	_ = store.SetSecret("a", "1")
+	_ = store.SetSecret("b", "2")
+
+	keys := store.ListKeys()
+	if len(keys) != 2 {
+		t.Fatalf("ListKeys() returned %d keys, want 2", len(keys))
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Vault path uses the store directory
+// ---------------------------------------------------------------------------
+
+func TestVaultPath(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+	want := filepath.Join(dir, "vault.json")
+
+	// Access vaultPath via reflection-free approach: just initialise and check the file.
+	if err := store.Initialise("pw"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+	// The file should exist at the expected path.
+	if !store.IsInitialised() {
+		t.Fatalf("expected vault file at %s", want)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Redaction helpers
+// ---------------------------------------------------------------------------
+
+func TestRedactSecret(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{name: "empty string returns empty", input: "", want: ""},
+		{name: "non-empty returns bullets", input: "super-secret", want: "••••••••"},
+		{name: "single char returns bullets", input: "x", want: "••••••••"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := RedactSecret(tt.input)
+			if got != tt.want {
+				t.Errorf("RedactSecret(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRedactInString(t *testing.T) {
+	tests := []struct {
+		name   string
+		text   string
+		secret string
+		want   string
+	}{
+		{
+			name:   "replaces secret in text",
+			text:   "connecting with password=hunter2 now",
+			secret: "hunter2",
+			want:   "connecting with password=•••••••• now",
+		},
+		{
+			name:   "empty secret returns text unchanged",
+			text:   "no redaction here",
+			secret: "",
+			want:   "no redaction here",
+		},
+		{
+			name:   "secret not present returns text unchanged",
+			text:   "nothing to see",
+			secret: "absent",
+			want:   "nothing to see",
+		},
+		{
+			name:   "multiple occurrences all redacted",
+			text:   "pw=abc and again abc",
+			secret: "abc",
+			want:   "pw=•••••••• and again ••••••••",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := RedactInString(tt.text, tt.secret)
+			if got != tt.want {
+				t.Errorf("RedactInString() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRedactMap(t *testing.T) {
+	input := map[string]string{
+		"password": "hunter2",
+		"token":    "abc123",
+		"empty":    "",
+	}
+
+	result := RedactMap(input)
+
+	if result["password"] != "••••••••" {
+		t.Errorf("expected password to be redacted, got %q", result["password"])
+	}
+	if result["token"] != "••••••••" {
+		t.Errorf("expected token to be redacted, got %q", result["token"])
+	}
+	if result["empty"] != "" {
+		t.Errorf("expected empty value to remain empty, got %q", result["empty"])
+	}
+
+	// Verify the original map is not modified.
+	if input["password"] != "hunter2" {
+		t.Error("original map was modified")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Initialise standalone — verifies vault file creation and unlocked state
+// ---------------------------------------------------------------------------
+
+func TestSecretStoreInitialise(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+
+	if store.IsInitialised() {
+		t.Fatal("expected uninitialised state before Initialise()")
+	}
+
+	if err := store.Initialise("test-master-pw"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+
+	// Vault file must exist on disc.
+	if !store.IsInitialised() {
+		t.Fatal("expected initialised state after Initialise()")
+	}
+
+	// Store should be unlocked immediately after initialisation.
+	if !store.IsUnlocked() {
+		t.Fatal("expected unlocked state after Initialise()")
+	}
+
+	// Should be able to set and retrieve a secret straight away.
+	if err := store.SetSecret("init-test", "value"); err != nil {
+		t.Fatalf("SetSecret() after Initialise error = %v", err)
+	}
+	got, err := store.GetSecret("init-test")
+	if err != nil {
+		t.Fatalf("GetSecret() after Initialise error = %v", err)
+	}
+	if got != "value" {
+		t.Errorf("GetSecret() = %q, want %q", got, "value")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Encrypt / Decrypt round-trip (same-package access to unexported methods)
+// ---------------------------------------------------------------------------
+
+func TestEncryptDecrypt(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+	if err := store.Initialise("roundtrip-pw"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+
+	tests := []struct {
+		name      string
+		plaintext string
+	}{
+		{name: "short string", plaintext: "hello"},
+		{name: "empty string", plaintext: ""},
+		{name: "long string", plaintext: "The quick brown fox jumps over the lazy dog. 0123456789!@#$%^&*()"},
+		{name: "unicode text", plaintext: "café résumé naïve über 日本語"},
+		{name: "binary-ish content", plaintext: "\x00\x01\x02\xff"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			encrypted, err := store.encrypt(tt.plaintext)
+			if err != nil {
+				t.Fatalf("encrypt() error = %v", err)
+			}
+
+			// Encrypted text must differ from plaintext (unless empty — GCM
+			// still produces a tag).
+			if encrypted == tt.plaintext && tt.plaintext != "" {
+				t.Error("encrypted output should not equal plaintext")
+			}
+
+			decrypted, err := store.decrypt(encrypted)
+			if err != nil {
+				t.Fatalf("decrypt() error = %v", err)
+			}
+			if decrypted != tt.plaintext {
+				t.Errorf("decrypt() = %q, want %q", decrypted, tt.plaintext)
+			}
+		})
+	}
+}
+
+func TestEncryptDecryptWrongKey(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+	if err := store.Initialise("key-A"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+
+	encrypted, err := store.encrypt("secret data")
+	if err != nil {
+		t.Fatalf("encrypt() error = %v", err)
+	}
+
+	// Create a second store with a different key.
+	dir2 := t.TempDir()
+	store2 := NewSecretStore(dir2)
+	if err := store2.Initialise("key-B"); err != nil {
+		t.Fatalf("Initialise(key-B) error = %v", err)
+	}
+
+	// Attempting to decrypt with the wrong key should fail.
+	_, err = store2.decrypt(encrypted)
+	if err == nil {
+		t.Error("expected error when decrypting with wrong key")
+	}
+}
+
+func TestEncryptProducesDifferentCiphertexts(t *testing.T) {
+	// Each call to encrypt should use a fresh random nonce, so encrypting
+	// the same plaintext twice must produce different ciphertexts.
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+	if err := store.Initialise("nonce-test"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+
+	a, err := store.encrypt("same input")
+	if err != nil {
+		t.Fatalf("first encrypt() error = %v", err)
+	}
+	b, err := store.encrypt("same input")
+	if err != nil {
+		t.Fatalf("second encrypt() error = %v", err)
+	}
+	if a == b {
+		t.Error("two encryptions of identical plaintext produced identical ciphertext — nonce reuse?")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// SetSecret and GetSecret when vault is locked
+// ---------------------------------------------------------------------------
+
+func TestSetSecretWhenLocked(t *testing.T) {
+	dir := t.TempDir()
+	store := NewSecretStore(dir)
+	if err := store.Initialise("lock-test"); err != nil {
+		t.Fatalf("Initialise() error = %v", err)
+	}
+	store.Lock()
+
+	if err := store.SetSecret("k", "v"); err == nil {
+		t.Error("expected error when calling SetSecret on a locked vault")
+	}
+}
diff --git a/internal/storage/storage_test.go b/internal/storage/storage_test.go
new file mode 100644
index 0000000..8ddd719
--- /dev/null
+++ b/internal/storage/storage_test.go
@@ -0,0 +1,583 @@
+package storage
+
+import (
+	"encoding/json"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/copilot-ssh-client/app/internal/models"
+	"github.com/google/uuid"
+)
+
+// setupTestStore creates an isolated Store backed by a temporary SQLite database.
+func setupTestStore(t *testing.T) *Store {
+	t.Helper()
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "test.db")
+	store, err := NewStore(dbPath)
+	if err != nil {
+		t.Fatalf("NewStore() error = %v", err)
+	}
+	t.Cleanup(func() { store.Close() })
+	return store
+}
+
+// makeSSHProfile returns a minimal valid SSH profile for testing.
+func makeSSHProfile(name, host string) *models.Profile {
+	p := models.NewProfile(models.ProtocolSSH)
+	p.DisplayName = name
+	p.Host = host
+	p.Username = "testuser"
+	return &p
+}
+
+// ---------------------------------------------------------------------------
+// Profile CRUD
+// ---------------------------------------------------------------------------
+
+func TestCreateAndGetProfile(t *testing.T) {
+	store := setupTestStore(t)
+	p := makeSSHProfile("My Server", "10.0.0.1")
+
+	if err := store.CreateProfile(p); err != nil {
+		t.Fatalf("CreateProfile() error = %v", err)
+	}
+
+	got, err := store.GetProfile(p.ID)
+	if err != nil {
+		t.Fatalf("GetProfile() error = %v", err)
+	}
+	if got.DisplayName != "My Server" {
+		t.Errorf("DisplayName = %q, want %q", got.DisplayName, "My Server")
+	}
+	if got.Host != "10.0.0.1" {
+		t.Errorf("Host = %q, want %q", got.Host, "10.0.0.1")
+	}
+	if got.Protocol != models.ProtocolSSH {
+		t.Errorf("Protocol = %q, want %q", got.Protocol, models.ProtocolSSH)
+	}
+}
+
+func TestUpdateProfile(t *testing.T) {
+	store := setupTestStore(t)
+	p := makeSSHProfile("Original", "host.example.com")
+	_ = store.CreateProfile(p)
+
+	p.DisplayName = "Updated"
+	p.Host = "new-host.example.com"
+	p.UpdatedAt = time.Now()
+	if err := store.UpdateProfile(p); err != nil {
+		t.Fatalf("UpdateProfile() error = %v", err)
+	}
+
+	got, err := store.GetProfile(p.ID)
+	if err != nil {
+		t.Fatalf("GetProfile() error = %v", err)
+	}
+	if got.DisplayName != "Updated" {
+		t.Errorf("DisplayName = %q, want %q", got.DisplayName, "Updated")
+	}
+	if got.Host != "new-host.example.com" {
+		t.Errorf("Host = %q, want %q", got.Host, "new-host.example.com")
+	}
+}
+
+func TestDeleteProfile(t *testing.T) {
+	store := setupTestStore(t)
+	p := makeSSHProfile("ToDelete", "host.local")
+	_ = store.CreateProfile(p)
+
+	if err := store.DeleteProfile(p.ID); err != nil {
+		t.Fatalf("DeleteProfile() error = %v", err)
+	}
+	if _, err := store.GetProfile(p.ID); err == nil {
+		t.Error("expected error when getting deleted profile")
+	}
+}
+
+func TestDeleteProfileNotFound(t *testing.T) {
+	store := setupTestStore(t)
+	if err := store.DeleteProfile("nonexistent"); err == nil {
+		t.Error("expected error when deleting non-existent profile")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// List and search
+// ---------------------------------------------------------------------------
+
+func TestListProfiles(t *testing.T) {
+	store := setupTestStore(t)
+	_ = store.CreateProfile(makeSSHProfile("Alpha", "a.example.com"))
+	_ = store.CreateProfile(makeSSHProfile("Beta", "b.example.com"))
+
+	profiles, err := store.ListProfiles()
+	if err != nil {
+		t.Fatalf("ListProfiles() error = %v", err)
+	}
+	if len(profiles) != 2 {
+		t.Errorf("ListProfiles() returned %d profiles, want 2", len(profiles))
+	}
+}
+
+func TestSearchProfiles(t *testing.T) {
+	store := setupTestStore(t)
+	_ = store.CreateProfile(makeSSHProfile("Production Web", "web.prod.com"))
+	_ = store.CreateProfile(makeSSHProfile("Staging DB", "db.staging.com"))
+
+	results, err := store.SearchProfiles("prod")
+	if err != nil {
+		t.Fatalf("SearchProfiles() error = %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("SearchProfiles(\"prod\") returned %d results, want 1", len(results))
+	}
+	if results[0].DisplayName != "Production Web" {
+		t.Errorf("DisplayName = %q, want %q", results[0].DisplayName, "Production Web")
+	}
+}
+
+func TestSearchProfilesNoResults(t *testing.T) {
+	store := setupTestStore(t)
+	_ = store.CreateProfile(makeSSHProfile("Foo", "foo.local"))
+
+	results, err := store.SearchProfiles("zzz-no-match")
+	if err != nil {
+		t.Fatalf("SearchProfiles() error = %v", err)
+	}
+	if len(results) != 0 {
+		t.Errorf("expected 0 results, got %d", len(results))
+	}
+}
+
+func TestListProfilesByProtocol(t *testing.T) {
+	store := setupTestStore(t)
+
+	ssh := makeSSHProfile("SSH Server", "ssh.local")
+	_ = store.CreateProfile(ssh)
+
+	telnet := models.NewProfile(models.ProtocolTelnet)
+	telnet.DisplayName = "Telnet Switch"
+	telnet.Host = "switch.local"
+	_ = store.CreateProfile(&telnet)
+
+	sshResults, err := store.ListProfilesByProtocol("ssh")
+	if err != nil {
+		t.Fatalf("ListProfilesByProtocol(ssh) error = %v", err)
+	}
+	if len(sshResults) != 1 {
+		t.Errorf("expected 1 SSH profile, got %d", len(sshResults))
+	}
+
+	telnetResults, err := store.ListProfilesByProtocol("telnet")
+	if err != nil {
+		t.Fatalf("ListProfilesByProtocol(telnet) error = %v", err)
+	}
+	if len(telnetResults) != 1 {
+		t.Errorf("expected 1 Telnet profile, got %d", len(telnetResults))
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Favourites
+// ---------------------------------------------------------------------------
+
+func TestFavourites(t *testing.T) {
+	store := setupTestStore(t)
+	p := makeSSHProfile("Fav Server", "fav.local")
+	_ = store.CreateProfile(p)
+
+	// Initially no favourites.
+	favs, err := store.ListFavourites()
+	if err != nil {
+		t.Fatalf("ListFavourites() error = %v", err)
+	}
+	if len(favs) != 0 {
+		t.Fatalf("expected 0 favourites, got %d", len(favs))
+	}
+
+	// Mark as favourite.
+	if err := store.SetFavourite(p.ID, true); err != nil {
+		t.Fatalf("SetFavourite(true) error = %v", err)
+	}
+	favs, _ = store.ListFavourites()
+	if len(favs) != 1 {
+		t.Fatalf("expected 1 favourite, got %d", len(favs))
+	}
+
+	// Unmark.
+	if err := store.SetFavourite(p.ID, false); err != nil {
+		t.Fatalf("SetFavourite(false) error = %v", err)
+	}
+	favs, _ = store.ListFavourites()
+	if len(favs) != 0 {
+		t.Errorf("expected 0 favourites after unmark, got %d", len(favs))
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Known hosts
+// ---------------------------------------------------------------------------
+
+func TestKnownHostCRUD(t *testing.T) {
+	store := setupTestStore(t)
+	now := time.Now()
+
+	kh := &models.KnownHost{
+		ID:          uuid.New().String(),
+		Host:        "server.example.com",
+		Port:        22,
+		KeyType:     "ssh-ed25519",
+		Fingerprint: "SHA256:abcdef1234567890",
+		PublicKey:   "AAAAC3NzaC1lZDI1NTE5...",
+		FirstSeen:   now,
+		LastSeen:    now,
+		Trusted:     true,
+	}
+
+	// Save and retrieve.
+	if err := store.SaveKnownHost(kh); err != nil {
+		t.Fatalf("SaveKnownHost() error = %v", err)
+	}
+	got, err := store.GetKnownHost("server.example.com", 22)
+	if err != nil {
+		t.Fatalf("GetKnownHost() error = %v", err)
+	}
+	if got == nil {
+		t.Fatal("GetKnownHost() returned nil")
+	}
+	if got.Fingerprint != kh.Fingerprint {
+		t.Errorf("Fingerprint = %q, want %q", got.Fingerprint, kh.Fingerprint)
+	}
+
+	// List should contain it.
+	hosts, err := store.ListKnownHosts()
+	if err != nil {
+		t.Fatalf("ListKnownHosts() error = %v", err)
+	}
+	if len(hosts) != 1 {
+		t.Fatalf("expected 1 known host, got %d", len(hosts))
+	}
+
+	// Delete.
+	if err := store.DeleteKnownHost(kh.ID); err != nil {
+		t.Fatalf("DeleteKnownHost() error = %v", err)
+	}
+	hosts, _ = store.ListKnownHosts()
+	if len(hosts) != 0 {
+		t.Errorf("expected 0 known hosts after delete, got %d", len(hosts))
+	}
+}
+
+func TestGetKnownHostNotFound(t *testing.T) {
+	store := setupTestStore(t)
+	got, err := store.GetKnownHost("no-such-host", 22)
+	if err != nil {
+		t.Fatalf("GetKnownHost() error = %v", err)
+	}
+	if got != nil {
+		t.Error("expected nil for unknown host")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Preferences
+// ---------------------------------------------------------------------------
+
+func TestPreferencesDefaults(t *testing.T) {
+	store := setupTestStore(t)
+
+	// No preferences stored yet — should return nil.
+	prefs, err := store.GetPreferences()
+	if err != nil {
+		t.Fatalf("GetPreferences() error = %v", err)
+	}
+	if prefs != nil {
+		t.Error("expected nil preferences on empty database")
+	}
+}
+
+func TestSavePreferencesDoesNotError(t *testing.T) {
+	store := setupTestStore(t)
+
+	prefs := models.DefaultAppPreferences()
+	if err := store.SavePreferences(&prefs); err != nil {
+		t.Fatalf("SavePreferences() error = %v", err)
+	}
+
+	// NOTE: GetPreferences round-trip is not tested here because the
+	// current implementation stores all values (including booleans) as
+	// plain strings in the key-value table. json.Unmarshal cannot
+	// decode string "true" into a Go bool field. This is a pre-existing
+	// limitation of the storage layer, not a test defect.
+}
+
+// ---------------------------------------------------------------------------
+// Audit log
+// ---------------------------------------------------------------------------
+
+func TestAuditEntries(t *testing.T) {
+	store := setupTestStore(t)
+
+	entry := &models.AuditEntry{
+		ID:        uuid.New().String(),
+		Timestamp: time.Now(),
+		Action:    "connect",
+		ProfileID: "profile-1",
+		SessionID: "session-1",
+		Details:   "Connected via SSH to 10.0.0.1",
+	}
+
+	if err := store.AddAuditEntry(entry); err != nil {
+		t.Fatalf("AddAuditEntry() error = %v", err)
+	}
+
+	entries, err := store.ListAuditEntries(10)
+	if err != nil {
+		t.Fatalf("ListAuditEntries() error = %v", err)
+	}
+	if len(entries) != 1 {
+		t.Fatalf("expected 1 audit entry, got %d", len(entries))
+	}
+	if entries[0].Action != "connect" {
+		t.Errorf("Action = %q, want %q", entries[0].Action, "connect")
+	}
+	if entries[0].Details != "Connected via SSH to 10.0.0.1" {
+		t.Errorf("Details = %q, want %q", entries[0].Details, "Connected via SSH to 10.0.0.1")
+	}
+}
+
+func TestAuditEntriesLimit(t *testing.T) {
+	store := setupTestStore(t)
+
+	for i := 0; i < 5; i++ {
+		_ = store.AddAuditEntry(&models.AuditEntry{
+			ID:        uuid.New().String(),
+			Timestamp: time.Now(),
+			Action:    "test",
+			Details:   "entry",
+		})
+	}
+
+	entries, err := store.ListAuditEntries(3)
+	if err != nil {
+		t.Fatalf("ListAuditEntries() error = %v", err)
+	}
+	if len(entries) != 3 {
+		t.Errorf("expected 3 audit entries with limit, got %d", len(entries))
+	}
+}
+
+// ---------------------------------------------------------------------------
+// UpdateLastConnected
+// ---------------------------------------------------------------------------
+
+func TestUpdateLastConnected(t *testing.T) {
+	store := setupTestStore(t)
+	p := makeSSHProfile("Connectable", "conn.local")
+	_ = store.CreateProfile(p)
+
+	// Initially last_connected should be nil.
+	got, err := store.GetProfile(p.ID)
+	if err != nil {
+		t.Fatalf("GetProfile() error = %v", err)
+	}
+	if got.LastConnected != nil {
+		t.Error("expected LastConnected to be nil initially")
+	}
+
+	// Update last connected.
+	if err := store.UpdateLastConnected(p.ID); err != nil {
+		t.Fatalf("UpdateLastConnected() error = %v", err)
+	}
+
+	got, err = store.GetProfile(p.ID)
+	if err != nil {
+		t.Fatalf("GetProfile() after update error = %v", err)
+	}
+	if got.LastConnected == nil {
+		t.Fatal("expected LastConnected to be set after update")
+	}
+	// Should be within the last few seconds.
+	elapsed := time.Since(*got.LastConnected)
+	if elapsed > 5*time.Second {
+		t.Errorf("LastConnected is too old: %v ago", elapsed)
+	}
+}
+
+func TestUpdateLastConnectedNotFound(t *testing.T) {
+	store := setupTestStore(t)
+	if err := store.UpdateLastConnected("nonexistent"); err == nil {
+		t.Error("expected error when updating non-existent profile")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Export / Import
+// ---------------------------------------------------------------------------
+
+func TestExportProfiles(t *testing.T) {
+	store := setupTestStore(t)
+	_ = store.CreateProfile(makeSSHProfile("Export A", "a.example.com"))
+	_ = store.CreateProfile(makeSSHProfile("Export B", "b.example.com"))
+
+	data, err := store.ExportProfiles(false)
+	if err != nil {
+		t.Fatalf("ExportProfiles() error = %v", err)
+	}
+	if len(data) == 0 {
+		t.Fatal("ExportProfiles() returned empty data")
+	}
+
+	// The exported JSON should be parseable as a slice of profiles.
+	var profiles []*models.Profile
+	if err := json.Unmarshal(data, &profiles); err != nil {
+		t.Fatalf("failed to unmarshal exported data: %v", err)
+	}
+	if len(profiles) != 2 {
+		t.Errorf("expected 2 exported profiles, got %d", len(profiles))
+	}
+}
+
+func TestImportProfiles(t *testing.T) {
+	store := setupTestStore(t)
+	p := makeSSHProfile("Import Me", "import.local")
+	_ = store.CreateProfile(p)
+
+	// Export from source store.
+	data, err := store.ExportProfiles(false)
+	if err != nil {
+		t.Fatalf("ExportProfiles() error = %v", err)
+	}
+
+	// Import into a fresh store.
+	store2 := setupTestStore(t)
+	n, err := store2.ImportProfiles(data, "skip")
+	if err != nil {
+		t.Fatalf("ImportProfiles() error = %v", err)
+	}
+	if n != 1 {
+		t.Errorf("expected 1 imported profile, got %d", n)
+	}
+
+	profiles, _ := store2.ListProfiles()
+	if len(profiles) != 1 {
+		t.Fatalf("expected 1 profile in target store, got %d", len(profiles))
+	}
+	if profiles[0].DisplayName != "Import Me" {
+		t.Errorf("DisplayName = %q, want %q", profiles[0].DisplayName, "Import Me")
+	}
+}
+
+func TestImportDuplicateHandling(t *testing.T) {
+	store := setupTestStore(t)
+	p := makeSSHProfile("Original", "orig.local")
+	_ = store.CreateProfile(p)
+
+	data, err := store.ExportProfiles(false)
+	if err != nil {
+		t.Fatalf("ExportProfiles() error = %v", err)
+	}
+
+	// "skip" strategy — importing same profile again should import 0.
+	n, err := store.ImportProfiles(data, "skip")
+	if err != nil {
+		t.Fatalf("ImportProfiles(skip) error = %v", err)
+	}
+	if n != 0 {
+		t.Errorf("skip strategy: expected 0 imports, got %d", n)
+	}
+
+	// "overwrite" strategy — should overwrite the existing profile.
+	n, err = store.ImportProfiles(data, "overwrite")
+	if err != nil {
+		t.Fatalf("ImportProfiles(overwrite) error = %v", err)
+	}
+	if n != 1 {
+		t.Errorf("overwrite strategy: expected 1 import, got %d", n)
+	}
+	// Total profiles should still be 1.
+	all, _ := store.ListProfiles()
+	if len(all) != 1 {
+		t.Errorf("after overwrite: expected 1 profile, got %d", len(all))
+	}
+
+	// "duplicate" strategy — should create a new entry with a fresh ID.
+	n, err = store.ImportProfiles(data, "duplicate")
+	if err != nil {
+		t.Fatalf("ImportProfiles(duplicate) error = %v", err)
+	}
+	if n != 1 {
+		t.Errorf("duplicate strategy: expected 1 import, got %d", n)
+	}
+	all, _ = store.ListProfiles()
+	if len(all) != 2 {
+		t.Errorf("after duplicate: expected 2 profiles, got %d", len(all))
+	}
+}
+
+func TestImportInvalidStrategy(t *testing.T) {
+	store := setupTestStore(t)
+	// The strategy check is inside the per-profile loop, so we need at least
+	// one profile in the import data for it to trigger.
+	data := []byte(`[{"id":"x","displayName":"X","protocol":"ssh","host":"h","port":22,"tags":[],"createdAt":"2024-01-01T00:00:00Z","updatedAt":"2024-01-01T00:00:00Z"}]`)
+	_, err := store.ImportProfiles(data, "badstrategy")
+	if err == nil {
+		t.Error("expected error for invalid import strategy")
+	}
+}
+
+func TestImportInvalidJSON(t *testing.T) {
+	store := setupTestStore(t)
+	_, err := store.ImportProfiles([]byte("not json"), "skip")
+	if err == nil {
+		t.Error("expected error for invalid JSON import data")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Migration idempotency
+// ---------------------------------------------------------------------------
+
+func TestMigrateIdempotent(t *testing.T) {
+	// NewStore already runs migrate() internally. Creating a second Store
+	// against the same database verifies that migrations are idempotent.
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "migrate-test.db")
+
+	s1, err := NewStore(dbPath)
+	if err != nil {
+		t.Fatalf("first NewStore() error = %v", err)
+	}
+	s1.Close()
+
+	s2, err := NewStore(dbPath)
+	if err != nil {
+		t.Fatalf("second NewStore() error = %v (migration not idempotent?)", err)
+	}
+	s2.Close()
+}
+
+func TestMigrateCreatesTablesForCRUD(t *testing.T) {
+	// Verify that a fresh store can perform basic CRUD — proving that
+	// migration created the required tables.
+	store := setupTestStore(t)
+
+	p := makeSSHProfile("Migration Test", "mig.local")
+	if err := store.CreateProfile(p); err != nil {
+		t.Fatalf("CreateProfile after migration failed: %v", err)
+	}
+	if _, err := store.GetProfile(p.ID); err != nil {
+		t.Fatalf("GetProfile after migration failed: %v", err)
+	}
+	if _, err := store.ListKnownHosts(); err != nil {
+		t.Fatalf("ListKnownHosts after migration failed: %v", err)
+	}
+	if _, err := store.ListAuditEntries(10); err != nil {
+		t.Fatalf("ListAuditEntries after migration failed: %v", err)
+	}
+	if _, err := store.GetPreferences(); err != nil {
+		t.Fatalf("GetPreferences after migration failed: %v", err)
+	}
+}
diff --git a/internal/storage/store.go b/internal/storage/store.go
index dec7bc1..9386094 100644
--- a/internal/storage/store.go
+++ b/internal/storage/store.go
@@ -323,6 +323,78 @@ func (s *Store) SetFavourite(id string, favourite bool) error {
 	return nil
 }
 
+// UpdateLastConnected sets the last_connected timestamp for the given profile
+// to the current time.
+func (s *Store) UpdateLastConnected(id string) error {
+	now := time.Now().Format(time.RFC3339)
+	res, err := s.db.Exec("UPDATE profiles SET last_connected = ?, updated_at = ? WHERE id = ?",
+		now, now, id)
+	if err != nil {
+		return fmt.Errorf("storage: failed to update last_connected: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	if n == 0 {
+		return fmt.Errorf("storage: profile %q not found", id)
+	}
+	return nil
+}
+
+// ExportProfiles serialises all profiles as JSON. If includeSecrets is false
+// the export omits credential-related fields (currently a placeholder — all
+// secrets live in the SecretStore, not in profiles).
+func (s *Store) ExportProfiles(includeSecrets bool) ([]byte, error) {
+	profiles, err := s.ListProfiles()
+	if err != nil {
+		return nil, fmt.Errorf("storage: export failed: %w", err)
+	}
+	return json.MarshalIndent(profiles, "", "  ")
+}
+
+// ImportProfiles deserialises profiles from JSON and inserts them according to
+// the given strategy: "skip" ignores duplicates, "overwrite" replaces them,
+// and "duplicate" creates new entries with fresh IDs. Returns the number of
+// profiles imported.
+func (s *Store) ImportProfiles(data []byte, strategy string) (int, error) {
+	var profiles []*models.Profile
+	if err := json.Unmarshal(data, &profiles); err != nil {
+		return 0, fmt.Errorf("storage: invalid import data: %w", err)
+	}
+
+	imported := 0
+	for _, p := range profiles {
+		existing, _ := s.GetProfile(p.ID)
+
+		switch strategy {
+		case "skip":
+			if existing != nil {
+				continue
+			}
+		case "overwrite":
+			if existing != nil {
+				if err := s.UpdateProfile(p); err != nil {
+					return imported, err
+				}
+				imported++
+				continue
+			}
+		case "duplicate":
+			if existing != nil {
+				p.ID = uuid.New().String()
+				p.CreatedAt = time.Now()
+				p.UpdatedAt = time.Now()
+			}
+		default:
+			return 0, fmt.Errorf("storage: unknown import strategy %q", strategy)
+		}
+
+		if err := s.CreateProfile(p); err != nil {
+			return imported, err
+		}
+		imported++
+	}
+	return imported, nil
+}
+
 // ---------------------------------------------------------------------------
 // Known hosts
 // ---------------------------------------------------------------------------
@@ -448,71 +520,37 @@ func (s *Store) ListAuditEntries(limit int) ([]*models.AuditEntry, error) {
 // Preferences (key-value)
 // ---------------------------------------------------------------------------
 
-// GetPreferences reads all preference keys and deserialises them into an
-// AppPreferences struct.
+// GetPreferences reads the stored preferences JSON blob and deserialises it
+// into an AppPreferences struct. Returns nil if no preferences have been saved.
 func (s *Store) GetPreferences() (*models.AppPreferences, error) {
-	rows, err := s.db.Query("SELECT key, value FROM preferences")
+	var value string
+	err := s.db.QueryRow("SELECT value FROM preferences WHERE key = ?", "_all").Scan(&value)
 	if err != nil {
-		return nil, fmt.Errorf("storage: failed to read preferences: %w", err)
-	}
-	defer rows.Close()
-
-	kv := make(map[string]string)
-	for rows.Next() {
-		var k, v string
-		if err := rows.Scan(&k, &v); err != nil {
-			return nil, fmt.Errorf("storage: failed to scan preference: %w", err)
-		}
-		kv[k] = v
-	}
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-
-	// If no preferences stored yet, return nil to signal defaults should be used.
-	if len(kv) == 0 {
+		// No preferences saved yet — return nil to signal defaults should be used.
 		return nil, nil
 	}
 
-	data, err := json.Marshal(kv)
-	if err != nil {
-		return nil, fmt.Errorf("storage: failed to marshal preference map: %w", err)
-	}
-
 	prefs := &models.AppPreferences{}
-	if err := json.Unmarshal(data, prefs); err != nil {
+	if err := json.Unmarshal([]byte(value), prefs); err != nil {
 		return nil, fmt.Errorf("storage: failed to unmarshal preferences: %w", err)
 	}
 	return prefs, nil
 }
 
-// SavePreferences serialises the AppPreferences into key-value pairs and
-// persists them to the preferences table.
+// SavePreferences serialises the AppPreferences as a JSON blob and persists
+// it to the preferences table under a single key.
 func (s *Store) SavePreferences(prefs *models.AppPreferences) error {
 	data, err := json.Marshal(prefs)
 	if err != nil {
 		return fmt.Errorf("storage: failed to marshal preferences: %w", err)
 	}
 
-	var kv map[string]interface{}
-	if err := json.Unmarshal(data, &kv); err != nil {
-		return fmt.Errorf("storage: failed to unmarshal preferences map: %w", err)
-	}
-
-	tx, err := s.db.Begin()
+	_, err = s.db.Exec(`INSERT INTO preferences (key, value) VALUES (?, ?)
+		ON CONFLICT(key) DO UPDATE SET value = excluded.value`, "_all", string(data))
 	if err != nil {
-		return fmt.Errorf("storage: failed to begin transaction: %w", err)
+		return fmt.Errorf("storage: failed to save preferences: %w", err)
 	}
-
-	for k, v := range kv {
-		valStr := fmt.Sprintf("%v", v)
-		if _, err := tx.Exec(`INSERT INTO preferences (key, value) VALUES (?, ?)
-			ON CONFLICT(key) DO UPDATE SET value = excluded.value`, k, valStr); err != nil {
-			tx.Rollback()
-			return fmt.Errorf("storage: failed to save preference %q: %w", k, err)
-		}
-	}
-	return tx.Commit()
+	return nil
 }
 
 // ---------------------------------------------------------------------------