Trust & privacy

Security

Security isn't a feature — it's the foundation of everything we build.

Client-Side Encryption

Your vault is encrypted with AES-256-GCM before it ever leaves your device. The encryption key is derived from your master password using PBKDF2.

Zero-Knowledge Architecture

We cannot read your authenticator secrets. Only encrypted ciphertext is stored on our servers.

Argon2id Password Hashing

Account passwords are hashed with Argon2id — strong resistance against brute-force attacks.

Secure Token Management

Short-lived access tokens and rotating refresh tokens. HTTP-only cookies with secure flags in production.

Rate Limiting

Authentication endpoints are rate-limited. Failed login attempts are logged as security events.

Security Event Logging

Every login, password change, and device revocation is logged in your dashboard.

Encryption Details

Vault Encryption

  • Algorithm: AES-256-GCM
  • Key derivation: PBKDF2-SHA256
  • Unique nonce per encryption
  • Random salt per vault

Transport Security

  • TLS 1.2+ required in production
  • HSTS enabled
  • CORS with credential support
  • Secure cookie flags