Security Foundation
Don't trust us.
Verify us.
Every security claim on this page is independently verifiable — in your browser, without taking our word for it.
3-Phase Audit Roadmap
Responsible disclosure programme active. Valid findings earn public Hall of Fame credit and CVE. Full audit report published publicly upon completion.
View audit roadmap →Verify in Your Browser — Right Now
All cryptographic primitives are browser-native. Open DevTools → Console and run:
AES-256-GCM
crypto.subtle.generateKey({name:"AES-GCM",length:256},true,["encrypt","decrypt"])PBKDF2 key derivation
crypto.subtle.importKey("raw",new Uint8Array(32),"PBKDF2",false,["deriveKey"])Full crypto-core open-source release scheduled H2 2026 following external audit. No proprietary cryptography — ever.
View encryption standards →NIST-standardised authenticated encryption. Same standard used by NSA for TOP SECRET data. Browser-native via Web Crypto API — no external libraries.
100,000 iterations of key stretching. ~150ms per guess locally — brute force is economically unviable. Your master key never stored or transmitted.
Vault key split into 3 shards. Any 2 reconstruct — 1 alone reveals nothing. Information-theoretically secure. VaultPass holds at most 1 shard, never enough.
Zero-Knowledge Architecture
Every encryption step occurs in your browser before any data leaves your device. Zero VaultPass employees have the technical ability to read your vault — not because of policy, but because of mathematics. A full server compromise yields only encrypted ciphertext.
Run the proof in your browser →How It Works
Three steps to protect your digital legacy.
No third-party custody. No plaintext stored. Your secrets stay yours — even after you're gone.
Trusted By