Security model

Last updated 1 August 2026

This page describes what PassKrypt actually does, including where the guarantees stop. If anything here turns out to be wrong, we would rather hear about it than not — see reporting.

The short version

Your vault is encrypted on your device with a key derived from two secrets we never receive. Our servers store the resulting ciphertext and a one-way verifier used to sign you in. Nobody at PassKrypt can decrypt your data, and an attacker who steals our database gets a pile of AES-256-GCM ciphertext with no keys attached.

Two-secret key derivation

Every account has two client-side secrets:

  • Account Password — chosen and remembered by you.
  • Secret Key — 125 bits of randomness generated on your device at sign-up by the operating system's cryptographic random number generator. It is stored on each device you authorise and printed in your Recovery Kit. It is never sent to us.

Both are combined on your device to derive two independent 256-bit values:

  • an authentication key, which proves who you are. It is sent over TLS and stored only as a bcrypt hash, so the stored form cannot be replayed.
  • a master unlock key, which decrypts your vault. This value never leaves your device in any form.

The password half runs through PBKDF2-SHA256 at 250,000 iterations to make guessing expensive; the Secret Key half contributes entropy that guessing cannot reach. Combining them means a weak password alone does not put your vault at risk if our database is ever stolen.

How your vault is encrypted

Your vault is sealed with AES-256-GCM — authenticated encryption, so tampering is detected rather than silently decrypted. The data is encrypted under a random Vault Key, which is itself wrapped twice: once by your master unlock key, and once by your Recovery Key.

That double wrapping is what makes password recovery possible without us holding anything. Changing your password re-wraps the key; it never re-encrypts or exposes your data.

What our servers hold

We can see We cannot see
Email address, display name, plan, account status, when you last synced, and the byte size of your encrypted blob. Passwords, entry titles, usernames, notes, cards, attachments, TOTP secrets, folder and vault names — every part of the vault contents.

Account recovery

At sign-up your device generates a Recovery Kit: a two-page PDF containing your Secret Key, a Recovery Key, and a QR setup code for authorising a new device. It is produced on your machine, not ours.

One deliberate exception to zero-knowledge. So that you are not left without a Kit if your device fails before you save it, the Kit is attached to your welcome email. It passes through our mail path in memory and is never written to disk or database. It does mean anyone with access to your inbox at that moment could read it — which is the honest trade we made for onboarding safety. Print the Kit, then delete that email.

If you forget your password, the reset page uses your Recovery Key to unwrap the Vault Key in your browser and re-wrap it under a new password. The vault ciphertext itself never leaves the server during a reset, and we never learn any key involved.

Where the guarantees stop

Three limits worth stating plainly:

  • Lose everything and it is gone. If you lose your Account Password, your Secret Key and your Recovery Key, no one can restore your vault. Not support, not a court order, not us. That is the direct consequence of holding no keys.
  • The web vault is a weaker tier than the desktop app. Browser-delivered cryptography means the code is re-fetched from our servers on every visit, so using it requires trusting that we serve honest code each time. The desktop app changes only when you choose to update it. If your threat model includes us, use the desktop app.
  • Your device is part of the boundary. Malware with access to your unlocked session can read what you can read. No password manager can prevent that.

Infrastructure

  • TLS on every connection, with certificates from Let's Encrypt and HSTS enabled.
  • Servers in the European Union (Frankfurt).
  • Rate limiting on authentication and email endpoints; sign-in is deliberately slow to compute so guessing does not scale.
  • Changing your password or completing a recovery reset immediately invalidates sessions on every device.
  • Encrypted database backups, taken daily and verified automatically — a backup that cannot be restored is not a backup.
  • This site loads no third-party scripts and makes no cross-origin requests. It runs under a Content Security Policy that forbids inline script entirely.

Reporting a vulnerability

If you believe you have found a security issue, email security@passkrypt.com. Please include enough detail to reproduce it. We will acknowledge within 72 hours and keep you updated until it is resolved.

We will not pursue legal action against anyone who reports a genuine issue in good faith, who avoids privacy violations and service degradation, and who gives us reasonable time to fix it before publishing. Machine-readable details are at /.well-known/security.txt.

Independent review

PassKrypt has not yet had a third-party security audit. We would rather say so than imply otherwise. When one is completed, the report will be linked here.