Security model
How we keep your vault unreadable, even to us.
Zero-knowledge means the service that stores your data has no way to read it. Your master password never leaves your device: it derives the key that encrypts your vault inside your browser, and only the encrypted result is uploaded. If our servers were breached, an attacker would get ciphertext and nothing else.
- 01
Your key is made on your device
Your master password runs through PBKDF2-SHA256 for 250,000 rounds in your browser to derive your key. The password itself is never sent to us or stored anywhere.
PBKDF2-SHA256 · 250,000 rounds - 02
Everything is encrypted before upload
Passwords, notes, files and documents are sealed with AES-256-GCM, which also detects tampering. Each file gets its own key, wrapped by yours.
AES-256-GCM · per-file keys - 03
We store ciphertext, and only that
Our servers hold encrypted bytes in South Africa. Without your master password nobody can read them: not us, not an attacker, not anyone.
Hosted in South Africa
What happens to my master password?
Nothing leaves your device. Your browser derives two separate values from it: a key that unlocks your vault, and a login hash we can check. The two are domain-separated, so the hash we store cannot be turned back into your key.
- PBKDF2-SHA256 with 250,000 iterations and a random per-account salt
- Encryption key and login hash derived with different labels
- The master password is never transmitted, logged or stored
How is my vault encrypted?
A random 256-bit vault key encrypts everything with AES-256-GCM, an authenticated cipher that also detects tampering. Your master-password key wraps the vault key; every encryption uses a fresh random 96-bit IV.
- AES-256-GCM through the browser’s built-in Web Crypto API
- Each file has its own content key, wrapped by your vault key
- Rotate your vault key at any time; every item is re-encrypted
How can I recover my account without you holding my key?
At sign-up you receive a one-time recovery code. Your vault key is wrapped a second time with a key derived from that code, so either your master password or the code can unlock it. We hold neither.
- Recovery code shown once; store it offline
- Emergency access lets a trusted contact request your vault after a waiting period you set
- Business organisations can opt in to admin-assisted recovery using sealed keys
Do breach checks expose my passwords?
No. We use HaveIBeenPwned’s k-anonymity range search: your browser hashes the password and sends only the first five characters of its SHA-1 hash. The match against hundreds of similar hashes happens on your device.
- Your password and its full hash never leave your device
- Weak, reused and old passwords are scored locally
How is my account protected at sign-in?
Add an authenticator app (TOTP) or a FIDO2/WebAuthn security key as a second factor. Sessions lock automatically when you are idle, and a security log shows recent sign-ins and changes.
- TOTP authenticator apps and FIDO2 / WebAuthn security keys
- Automatic lock after inactivity
- Activity log of sign-ins and security changes
Where does my data live, and what can you see?
Encrypted data is stored on Amazon Web Services in South Africa, and travels only over TLS. We can see what any service needs to bill and operate: your email address, plan, storage used and when you sign in. Never the contents of your vault.
- Amazon Web Services, in South Africa
- HTTPS with HSTS and a strict Content Security Policy
- Personal information processed in line with POPIA
Found a vulnerability?
Please tell us privately at support@thesecretsvault.com before disclosing it publicly. We read every report and will keep you updated while we fix it.