Security & architecture

End-to-end encrypted storage. Your master key never leaves this device.

What the server sees

Only ciphertext: AES-256-GCM blobs, Argon2 verifiers, WebAuthn public keys. A stolen database does not contain your passwords — an attacker still needs your master password.

Key derivation

Argon2id (t=3, m=64MB) in your browser derives a master key; HKDF splits it into a login hash sent to the server and a data key that never leaves the device.

Second factors

Passkeys are phishing-proof and reveal nothing about your vault. TOTP seeds must live on the server to verify codes — vault data stays encrypted either way. Guessing is throttled and burns the login session.

Sharing

Each shared vault has its own key, wrapped per member with ECDH P-256. Verify fingerprints by call or message before sharing. Removing a member rotates the key; copies they already synced stay readable.

Honest limits

No recovery if you forget the master password. No software is unhackable — this design makes a server breach useless without your password. Don't unlock on computers you don't trust.