Zero-Knowledge Architecture

Your Master Password never leaves your device. The server only receives a cryptographic hash that cannot be reversed to obtain your password.

End-to-End Encryption

All your passwords and notes are encrypted with AES-256-GCM before being sent to the server. Only you can decrypt them with your Master Password.

Key Derivation

Your Master Password is processed through Argon2id, a memory-hard algorithm that makes brute-force attacks extremely slow and expensive.

What the Server Stores

• Your username
• A cryptographic salt (random data)
• A hash for authentication (not your password)
• Your encrypted vault (unreadable without your password)

What the Server Never Sees

• Your Master Password
• Your decrypted passwords
• Your decrypted notes

Even if the server is compromised, your data remains encrypted and secure.