Security
Security isn't a feature — it's the foundation of everything we build.
Client-Side Encryption
Your vault is encrypted with AES-256-GCM before it ever leaves your device. The encryption key is derived from your master password using PBKDF2.
Zero-Knowledge Architecture
We cannot read your authenticator secrets. Only encrypted ciphertext is stored on our servers. Without your master password, your data is unreadable.
Argon2id Password Hashing
Account passwords are hashed with Argon2id, the winner of the Password Hashing Competition, providing strong resistance against brute-force attacks.
Secure Token Management
Short-lived access tokens and rotating refresh tokens protect your sessions. Tokens are stored in HTTP-only cookies with secure flags in production.
Rate Limiting
Authentication endpoints are rate-limited to prevent brute-force attacks. Failed login attempts are logged as security events.
Security Event Logging
Every login, password change, device revocation, and API key action is logged. Review your security timeline in the dashboard.
Encryption Details
Vault Encryption
- Algorithm: AES-256-GCM
- Key derivation: PBKDF2-SHA256
- Unique nonce per encryption
- Random salt per vault
Transport Security
- TLS 1.2+ required in production
- HSTS enabled
- CORS with credential support
- Secure cookie flags