Encrypted on your device. Honestly explained.
How we protect your passwords, what our server still sees – and where the limits of any such solution are.
Review status
How the encryption works
Only established methods from the browser (WebCrypto) and Argon2id – no home-made cryptography.
| Building block | What it does |
|---|---|
| Master password → key | Argon2id with 64 MiB of memory and 3 passes turns your master password into a key on your device. Every guess therefore costs a lot of computing time and memory. |
| Account key | A random 256-bit key, wrapped with the key derived from your master password. Changing your password only re-wraps it – your entries stay as they are. |
| One key per entry | Every entry has its own key and is encrypted with AES-256-GCM – including title, folder and address. Entries are padded to fixed size classes so that their length reveals little. |
| List of all entries | An encrypted list records which entries exist and in which state. If the server leaves one out or delivers an old one, your device shows a visible warning. |
| Secret key (optional) | A second, random key that only lives on your devices and is mixed into the derivation. Without it, stolen data does not help even if your master password is weak. |
| Important changes | Changing the master password, a new recovery key, deleting the vault: your device signs each of these steps. A stolen session alone is not enough. |
There is no backdoor, no master key and no “support access”. We cannot reset your master password and cannot decrypt your entries.
Your master password must not be your sign-in password: setup checks on your device whether the two are the same or very similar and rejects that. We explain why right there.
What our server sees – and what it does not
The server does not see
- your master password and your secret key
- your passwords, notes, cards and identities
- titles, folder names and addresses of your entries
- your account key in plain text
The server necessarily sees
- how many entries you have and which size class each one falls into (1 to 32 KiB)
- revision numbers per entry and for the whole vault
- when something was written (in answers to devices only as a day)
- when you move something to the trash, import (only the number), change your master password or renew the account key
- your connected devices with the name you chose, platform, browser family and last unlock
- shortened network identifiers (hash), as with every sign-in
Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now.
The limits – said openly
Every password manager has limits. These are ours.
The web app and the extension are not equally protected
A weak master password remains a risk
A new device cannot always recognise an old state
No access without your master password and recovery key
Protection when filling
Against phishing and slipped-in forms.
- Filling only happens after your click – never automatically when a page loads.
- Only logins for exactly this address are suggested. Look-alike addresses and other subdomains get nothing.
- Nothing is filled into embedded frames from foreign addresses, nor into invisible or covered fields.
- On unencrypted pages (http) the extension asks first in its own window.
Found a vulnerability?
How to report a vulnerability to us is described on our security page.
Beta: the password manager works but has not yet been externally reviewed. Create your emergency sheet and export your passwords regularly. We open the beta step by step. After signing up, you request access with one click.