Security
We built Enclave so we can't read it either.
Most services ask you to trust a promise. Enclave is zero-knowledge: your data is encrypted on your device with a key only you hold, so privacy comes from the mathematics — not from our good behavior. Here is how it works, in plain language.
Master password stays local
When you unlock Enclave, your master password is turned into an encryption key right in your browser using Argon2id — a slow, memory-hard function designed to resist guessing attacks. The password and the key are never sent to us.
Everything is sealed before it syncs
Every password, note, card, and key is encrypted on your device with AES-256-GCM before it goes anywhere. Syncing just moves sealed envelopes — the contents stay unreadable in transit and at rest.
Our servers store ciphertext only
What we keep is encrypted data: strings of noise that are useless without your key. There is no 'admin view' of your vault and no way for us — or anyone who breaches us — to read it.
Sharing re-encrypts to the recipient
When you share an item, your browser encrypts a copy with the recipient's RSA-4096 public key. Only their private key — stored encrypted with their own vault — can open it. Expiry and view limits are enforced on top.
One-time links burn after reading
Secrets sent by link are encrypted with a key that lives only in the link itself, never on our servers. Once the view limit is reached or the link expires, the ciphertext is destroyed.
Breach checks expose nothing
Password health checks use k-anonymity: your browser sends only a short hash prefix, so neither we nor the breach database ever sees your password or even its full hash.
What this means in practice
- If our database were ever stolen, attackers would get encrypted noise — not your passwords.
- We cannot reset your master password. Your recovery key is the only way back in — keep it somewhere safe.
- The trade-off of real zero-knowledge: no one can snoop, and no one can restore your vault without your key. We think that's the right trade.