Why we can't see
your data.
It's not a policy. It's not a promise. It's the architecture. Encryption and decryption happen entirely on your device — our servers are nothing more than a vault for sealed, unreadable boxes.
On your device
On our servers
The Lifecycle of a Secret
Plaintext never crosses the wire
Follow a single password from the moment you type it to the moment it's stored. At no point does a readable value — or a usable key — touch our infrastructure.
Encrypted on your device
You type a password. Before anything leaves your browser, it is encrypted with your vault's Data Encryption Key using AES-256-GCM via the Web Crypto API.
Only ciphertext travels
A base64-encoded encrypted envelope is sent over TLS 1.3. The plaintext — and the keys that protect it — never leave your machine.
Stored as an opaque blob
Our servers store the envelope exactly as received. They never decrypt it, never parse it, and have no key capable of opening it.
Decrypted back on your device
When you return, the same envelope is fetched and decrypted locally with your key. The round trip never exposed a single readable byte.
How We Stay Blind
Trust, removed from the equation
Zero-knowledge isn't one feature — it's a set of guarantees enforced at every gate, transfer, and share.
A two-gate model
Signing in only proves who you are (the JWT gate). It does not unlock your vault. A second gate — proven by an HMAC-SHA256 challenge over your master key — is required before any secret can be decrypted. A stolen session token alone opens nothing but ciphertext.
Your secret never transmitted
Your Password-Derived Secret is computed in your browser and cached only in session memory. It is never sent to us, and on logout it is wiped — so re-entering it is the only way back in.
Proof without exposure
To unlock, your browser derives the key, then sends a one-time HMAC proof that it succeeded. The server validates the proof mathematically — without ever possessing the key it proves knowledge of. The key is wiped from memory the instant the ceremony ends.
Zero-knowledge sharing
Share a vault and its key is re-wrapped with the recipient's RSA-2048 public key — only their private key can open it. Secure links keep their symmetric key in the URL fragment, which browsers never send to the server.
Your data, your keys, your knowledge alone
Experience a password manager that is mathematically incapable of reading your secrets.
Start Free Trial