Are my passwords safe here?
Short answer: yes. Your passwords are locked with a key only you hold – right in your browser, before they ever reach us. Here is how, without the jargon.
Think of a safe-deposit box
We provide the box and the vault room it sits in – but you hold the only key. When you put a password in, it is locked with your key while still in your hand, before it even leaves your device. What we receive and store is a locked box we cannot open.
Your key is your master password. It is turned into an encryption key right in your browser and is never sent to us. That is why we can never read your passwords – we simply never have them in readable form.
What you might be wondering
The most common questions – with honest answers.
Can you, who run the service, see my passwords?
No. Your passwords are encrypted on your device before they are sent to us, so we only receive an unreadable, locked version. We hold no key that can open it. Even if we wanted to, we could not see your passwords.
What if your server gets hacked?
An attacker would only find encrypted, unreadable data – like a safe with no combination. Your passwords can only be unlocked with your master password, which is never on our servers. Without it, the stolen data is useless.
Can the administrator or an employee read my passwords?
No one can – regardless of their access level. The encryption is done with your key on your device, and that key never leaves you. An administrator only sees the same unreadable, locked data stored on the server.
What happens if I forget my master password?
Here we are completely honest: because only you hold the key, we cannot reset it for you. That is the price of no one else being able to reach your passwords. That is why you get a recovery key when you create your account – keep it somewhere safe (for example printed), so you can unlock the vault even if you forget your master password.
Is it safe on my phone or computer?
Yes. Your passwords are only shown when you have unlocked the vault yourself, and the vault locks automatically after a while. You can also protect it with a PIN and two-factor sign-in. Just keep your own device free of malware, exactly as you would with your banking app.
Is this safer than saving passwords on my phone or in a notebook?
Yes, considerably. Passwords in notes or in the browser often sit unprotected and can be read by apps or by anyone who gets hold of the device. Here everything is encrypted with a key only you hold, and you can use unique, strong passwords for every service without having to remember them.
How do I know I can trust this?
You do not have to trust a promise – the security comes from how the system is built. Because the encryption happens on your device and the key never leaves you, it is technically impossible for us to read your passwords. The service also runs on secure infrastructure.
For those who want the technical details
Under the hood it uses well-established, modern cryptography – the same kind of protection banks and security firms rely on:
- Your master password is turned into an encryption key using Argon2id, a method built to resist guessing attacks.
- Your data is encrypted with AES-256-GCM – one of the strongest and most proven encryption methods available.
- All encryption and decryption happens in your browser. The server never receives your master password or your keys.
- The server only stores encrypted text. It cannot be turned back into your passwords without your key.
Ready to get started?
Create your vault and let only yourself hold the key.