Your master password is the only thing that opens the vault — and it never leaves your device or gets stored anywhere. Here's exactly how a secret travels from the screen into the encrypted database, and back again.
Press the controls to watch data move. Warm is your readable secret; cool is ciphertext on disk. Nothing is readable in the vault without the key held in memory.
Your password never encrypts data directly. It derives a wrapping key, which unlocks a random database key — the one that actually encrypts every item.
Known only to you. Never stored, never transmitted, never recoverable by anyone.
Argon2id churns your password + a 32-byte random salt through a large block of memory, making brute-force attacks with GPUs or specialized hardware ruinously expensive.
A random 256-bit key, itself stored only in encrypted form. The KEK unwraps it into memory.
Every password, card and note is individually encrypted with the database key.
Argon2id (RFC 9106) turns your password into a key by working through a large block of memory, not just raw computation — so the GPU and ASIC rigs that shred older KDFs lose their edge, even offline.
AES-256-GCM doesn't just scramble data — it attaches an authentication tag. If a single byte of the ciphertext is tampered with, decryption refuses.
The database key, salts and IVs come from the device's cryptographic RNG — never from your password or anything predictable.
Three recovery codes each help wrap a spare copy of the database key. Any two, in any order, can reopen the vault if you forget your password.
The database key lives only in RAM while the vault is open. Lock, auto-lock, or minimise, and its bytes are overwritten with zeros.
The app ships with no internet permission at all, so encrypted or not, your data has no path off the device unless you export it yourself.
If someone copied the database file, this is all they'd see. No master password, no plaintext, no key — only a salt, the KDF settings, and ciphertext. Even item titles, types and tags are encrypted.
| Table | Column | Stored value |
|---|---|---|
| metadata | kdf_salt | a19c…<32 random bytes>…7f |
| metadata | kdf_algorithm | argon2id |
| metadata | kdf_params | {"t":2,"m":19456,"p":1} |
| metadata | encrypted_dk | 3d0b…:4c8e…<database key wrapped by your password>… |
| metadata | recovery_dk_ab / bc / ac | …<database key wrapped by each pair of recovery codes>… |
| vault_items | title / type / tags | 7c33…:e0a1…<AES-256-GCM ciphertext + tag>… |
| vault_items | encrypted_details | 9f21…:8b7a…<AES-256-GCM ciphertext + tag>… |
| vault_items | encrypted_notes | c40e…:1d55…<ciphertext + tag>… |
| scanned_document_pages | encrypted_image_data | b8f2…:6a4d…<ciphertext + tag>… |