Everything in your vault is encrypted on your device, with a key built from two secrets only you have. What the server stores is encrypted text, an email address and timestamps. Nothing that would open a vault is ever sent to it.
Every primitive above is symmetric or hash-based. There is no public-key cryptography anywhere in Vault3, so there is nothing here for a quantum computer to break and nothing due to be replaced later. Each name is defined in the whitepaper.
Key derivation
Unlocking your vault takes two things. Your browser combines them into a single unlock key and derives every other key from it, all before anything is sent.
Your Master Password
Chosen by you, kept in your head, and never sent anywhere. Before it becomes part of a key it passes through two deliberate slowdowns, one after the other: a long run of standard arithmetic, then a stage that has to fill a block of memory for every attempt. Together they make large-scale guessing prohibitively expensive.
Argon2id · 64 MiB · 4 passes ← PBKDF2-SHA512 · 1,000,000 · per-account saltYour Secret Phrase
Twelve words your browser picks at random when you sign up, written into your Emergency Kit and kept on your device. No slowdown is applied here: the phrase is already uniformly random and long enough that searching it is infeasible, with enough margin to stay that way against a quantum computer.
12 words · 132 bits · HKDF-SHA512Master unlock key
Both secrets are required. A stolen phrase without the password, or a guessed password without the phrase, produces the wrong key.
Authentication key
This one is sent to the server, and its only job is to prove your identity. The server stores a hash of it rather than the key itself. It is a sibling of the encryption key rather than a copy, so it cannot decrypt anything.
Encryption key
This one never leaves your device. It unwraps your vault key, which unwraps a separate key for each item, which decrypts that item's contents. Every item is sealed with AES-256-GCM.
Storage
Your item contents, item titles, vault names and wrapped keys all arrive already encrypted. Here is one item as it looks on your device, and as it is stored.
On your device
decryptedIn the database
sealedhQ2nZpVt7aXeR4mKdJ0sLbYc9wUf…
C8xNiO3vTgHq1jEzPr6kAyWm5uDb…
Rf9LsQ4dBnM7tKcVaXo2eZuIhGp1…
A copy of the whole database shows how many items you keep, when they last changed, and your email address. It does not show what any of them contain.
The consequences
There is no internal tool, support path or administrative override that decrypts a vault. The envelope below is the whole of what anyone here can open.
There is no reset email and no internal recovery route, including one that would wipe the vault so you could start over. The server holds encrypted text and a hash of your authentication key, and neither can be turned back into a working key. Your Emergency Kit is the way back in, which is why saving it is a required step at sign-up.
An attacker who gets in leaves with encrypted items, one-way hashes and encrypted account fields. No readable copy of a secret is written anywhere, so there is none to find.
Sharing
Vault3 can pass something to another person without ever holding what opens it. The key travels in the part of a link that browsers keep on the device and never transmit, so what reaches the server is an encrypted bundle and an opaque token.
An opaque token, stored only as a hash. That is enough to expire a share or revoke one on request, and not enough to decrypt anything.
The key. Your browser generates it, seals the share with it and writes it into the link. The recipient's browser strips it from the address bar as soon as it has been read, so it does not persist in their history.
Anyone holding a complete link can read what it opens. That is what sharing means, and cryptography does not change it. The narrower claim is the one being made here: the server is not among them.
All of this protects your vault from the server and from anyone who attacks it. It does not protect a device that is already compromised: software running on your computer can read whatever you have unlocked there, and encryption does not change that. So keep your devices updated, keep your Emergency Kit on paper rather than on the machine, and use a Master Password you use nowhere else.
Go deeper
Every parameter, the exact key hierarchy, how sharing is built, why a quantum computer finds nothing here to break, how to rebuild the cryptography module yourself and check it byte for byte, and the threat model including the parts that cannot be defended.
Security reports go straight to the people who build Vault3. There is no form and no triage queue; we read them ourselves and reply quickly.
[email protected]One password to remember. Twelve words to keep safe. Everything else, encrypted.
Create your vaultOne cookie. No trackers.
Vault3 uses one cookie, and only to keep you signed in. There is nothing to agree to and nothing to switch off — no analytics, no advertising, nobody else watching.