Security Features
Encryption happens on your device, and the key stays with you. This page spells out how each layer works.
Zero-Knowledge Architecture
We can reach neither your master password nor your data. Even with sync on, all we get is ciphertext.
- The server holds ciphertext and no key to open it
- Your master password is never uploaded or backed up
- We cannot reset your master password
- Forget it and only your recovery key gets you back in
End-to-End Encryption
AES-256 encryption. Data is encrypted before it leaves your device, and only you hold the key.
- AES-256-GCM encryption
- Argon2id derives the key from your master password
- Encryption finishes before anything leaves the device
- TLS on top of that in transit
Flexible Storage
Stays on your device by default. You only need the network for multi-device sync — and you pick where it lives.
- Stays on your device by default — works offline
- Optional encrypted WebDAV backup
- Works with Nextcloud, Jianguoyun and standard WebDAV
- Or use storage hosted by KeyMe Pass
- Remote storage can be entirely self-managed
- Multi-device sync (membership feature)
Multi-Layer Protection
6-digit PIN, auto-lock, fingerprint / face unlock. Forget your master password and the recovery key gets you back in.
- 6-digit PIN for everyday unlocking
- The recovery key is the only way back in
- Locks itself on backgrounding or timeout
- Fingerprint / face unlock (key never leaves the device)
Technical Details
App Isolation
Data lives in the app-private directory behind the OS sandbox. Other apps cannot read it.
Encrypted Transfer
With sync on, transfers are end-to-end encrypted the whole way.
Data Integrity
Cryptographic hashes verify integrity, so tampering shows up.
Access Control
Only authenticated requests can reach your data.
WebDAV Encrypted Backup
End-to-end encrypted backup over WebDAV with a zero-trust server. Large files are encrypted separately.
Privacy Protection
We cannot read your vault contents, and we never sell them to anyone. There are no ads in the product. We do collect anonymous usage statistics to improve it — these never include your vault contents.
Security Standards
| Standard | What it does |
|---|---|
| AES-256 | Advanced Encryption Standard, 256-bit key length, widely adopted by governments and financial institutions worldwide |
| SHA-256 | Secure Hash Algorithm, used for encrypted storage of PIN codes |
| TOTP | Time-based One-Time Password algorithm, compliant with RFC 6238 standard |
| End-to-End Encryption | Data is encrypted at the sending end, only the receiving end can decrypt it — no middle party can view it |
| WebDAV Protocol | Encrypted backup based on standard WebDAV protocol, compatible with mainstream cloud storage services |
Our Security Commitment
Your data is only ever decrypted on your own devices — that isn't a promise, it's what the architecture allows. The key is derived from your master password on your device; storage holds encrypted content only.