Zero-knowledge password manager
Your passwords are encrypted before they leave your browser.
KeyVault derives your encryption key on your own device. Your master password is never sent, never stored, and never recoverable — which means the only person who can open your vault is you.
- /AES-256-GCM
- /PBKDF2 · 100,000 iterations
- /No plaintext on the server
- /No trackers, no ads
vault_entries · server view
{
"title": "GitHub",
"encryptedData": "7Yx2Qk9v...RmT4pA==",
"iv": "n1KdS8fQ2wLz"
}Username, password and URL live inside encryptedData. The decryption key exists only in your browser's memory, so this is genuinely everything we can see.
// How it works
Encryption that happens before the network does
Most password managers ask you to trust their servers. KeyVault is built so that trusting us is not part of the equation.
01
You type your master password
It goes into your browser and stops there. It is never put in a request body, never written to a log, and never stored on our side — not even hashed.
02
Your browser derives the key
PBKDF2-SHA256 with 100,000 iterations and a salt unique to your account turns that password into an AES-256 key. The key is marked non-extractable and lives only in tab memory.
03
Only ciphertext is uploaded
Each entry is sealed with AES-GCM under a fresh random IV before the request leaves your device. What reaches the database is a blob nobody here can open.
The same derivation runs at sign-in, which is how your vault reopens on any device without the key ever being transmitted.
// Transparency
Exactly what we hold, and what we never touch
No asterisks. This is the full contents of a KeyVault account as it exists on our side.
On our server
- Your name and email address
- A bcrypt hash of a value derived from your password
- The PBKDF2 salt unique to your account
- Entry titles, in plaintext
- Encrypted blobs and their initialisation vectors
- Creation and update timestamps
Never leaves your device
- Your master password
- Your AES-256 encryption key
- Usernames stored in your vault
- Passwords stored in your vault
- URLs attached to your entries
One honest caveat · entry titles are stored unencrypted so your vault list can render instantly without decrypting everything. Someone with database access would see that you have an account named "GitHub" — never the username, password or URL behind it. Name your entries accordingly.
// Features
Security you don't have to think about
The protective work happens on your device, quietly, every time you open the vault.
End-to-end encryption
Every entry is sealed with AES-256-GCM under a fresh random IV in your browser. The server receives ciphertext and nothing else.
Vault stays locked
Your key isn't kept anywhere. You unlock the vault with your master password each session, and it's discarded when you close the tab.
Re-confirm to reveal
Showing or copying a saved password asks for your master password again, so an unattended screen doesn't hand over your credentials.
Copy without looking
Send a username or password straight to the clipboard. Values stay hidden by default and are decrypted only in memory.
Verified accounts
Registration is confirmed by email through single-use, expiring links, and authentication attempts are rate limited against brute force.
Any modern browser
Built on the Web Crypto API that already ships with your browser. No extension, no install, no native app to keep updated.
// Security
The specifics, not the adjectives
You shouldn't have to take a password manager's word for it. Here are the actual parameters.
Cryptography
- Encryption
- AES-256-GCM (authenticated)
- Key derivation
- PBKDF2-SHA256 · 100,000 iterations
- Salt
- 128-bit, unique per account
- IV
- 96-bit, regenerated on every write
- Key handling
- Non-extractable, browser memory only
- Credential storage
- bcrypt over a client-derived hash
- Session
- HS256 JWT · httpOnly · SameSite=Lax · 7 days
- Transport
- HSTS · 1 year · includeSubDomains
Hardening
- Content-Security-Policy restricting every resource to this origin
- X-Frame-Options: DENY — the app cannot be embedded in an iframe
- X-Content-Type-Options: nosniff and a strict referrer policy
- Camera, microphone and geolocation disabled by Permissions-Policy
- Authorization re-checked at the data layer, scoped to your user id
- Rate limiting on registration, sign-in and every email link
- No third-party scripts, no analytics, no trackers
// FAQ
Questions worth asking before you trust us
Including the ones with uncomfortable answers.
What happens if I forget my master password?
Your vault cannot be recovered — by you or by us. The password is the encryption key, and we never receive it, so there is nothing on our side to recover with. You can request a reset link by email, but a reset creates a brand-new key and permanently deletes your saved entries. Treat your master password like a house key: memorable to you, and written down somewhere safe offline.
Can anyone at KeyVault read my passwords?
No, and it isn't a policy — it's the architecture. Encryption and decryption happen in your browser with a key derived from your master password. The database holds a ciphertext blob and its initialisation vector. There is no server-side decryption code to misuse, subpoena, or leak.
What if your database is breached?
An attacker would get your email, entry titles, and encrypted blobs. Opening a single one requires your master password, and every guess costs 100,000 PBKDF2-SHA256 iterations against a salt unique to your account. A strong, unique master password keeps the blobs useless.
Why are entry titles not encrypted?
So your vault list can render immediately without decrypting every record. It's a deliberate trade-off, and we'd rather state it than hide it: titles are visible to us, while usernames, passwords and URLs never are. If a title itself would be sensitive, name the entry something generic.
Can I use KeyVault on more than one device?
Yes. Sign in from any modern browser and your vault decrypts locally with the same master password. Nothing extra to install, and the key is still derived on each device rather than transmitted between them.
Is it safe to use on a shared computer?
The session cookie is httpOnly so page scripts can't read it, the encryption key is dropped when you close the tab, and revealing or copying a password asks for your master password again. Even so, sign out when you're done on a machine that isn't yours.
What do you do with my data?
Nothing beyond running the product. There are no analytics, no trackers and no third-party scripts — the content security policy blocks them outright. Your email address is used only for account verification and password reset.
How much does it cost?
Nothing. There is no paid tier, no trial countdown and no upsell in the vault. Create an account, verify your email, and start saving passwords.
Stop reusing the same password everywhere
Set one master password you actually remember, and let KeyVault keep every other credential encrypted, unique, and out of everyone else's reach — ours included.
- /Free, with no paid tier
- /Email verification, then you're in
- /Nothing readable ever reaches our servers