Security guide
Understand Vaults cryptographic and operational protections.
Zero-knowledge
Secrets are designed to be encrypted in the browser before storage. The server stores encrypted content and metadata required for operation.
- The master password stays local.
- Decrypted keys remain in browser memory during the session.
MFA
MFA can be required when opening a vault or again before revealing a sensitive secret.
KDF and Argon2id
The KDF derives cryptographic material from the master password with a computational cost intended to slow offline attacks.
Approved devices
Critical operations can be limited to registered and recently verified devices.