How the zero-knowledge model works, what happens if you lose a password, and how scoped tokens keep your agents in line.
Every credential is encrypted on your device with your vault key — using AES-256-GCM and a fresh random IV — before it ever reaches our servers. Our database holds only ciphertext and a salt. There is no vault-key column and no master-password hash we could brute-force, so there is nothing for us to decrypt from our side. If we ever received a breach or a legal demand, all we could hand over is encrypted data we cannot read.
Still have a question?
The security page walks through the zero-knowledge model in full — or just create a free vault and try it.