Security

Secure Pass is built around one rule: your master password and vault contents should never be readable by us, even under a subpoena or a server breach. Here's exactly how that works.

Key derivation

When you set your master password, your device derives a master key from it using PBKDF2-SHA256 with a per-account random salt and 600,000 iterations. The master password itself is never transmitted or stored, in any form.

Encryption

A random 256-bit vault key is generated on your device and encrypted ("wrapped") with your master key using AES-256-GCM. Every credential you save — and its label — is individually encrypted with that vault key, also using AES-256-GCM, before it is sent to our servers. We store ciphertext, an initialisation vector, and an authentication tag for each item; nothing more.

Authentication

Logging in doesn't send your password to us either. Your device derives a separate authentication key from your master key via HMAC-SHA256, and that's what we verify against a salted hash on our servers — using Argon2id, a memory-hard hashing algorithm chosen specifically to resist GPU-based cracking attempts if our database were ever exposed.

Transport

All traffic between your device and our servers is encrypted in transit with TLS 1.3.

Biometric & passkey login

Where supported, Secure Pass uses the WebAuthn standard with the PRF extension to let Face ID, Touch ID, Windows Hello, or Android fingerprint unlock your vault without re-entering your master password. Your biometric data is verified locally by your device and never leaves it — we only ever receive a public key and a signed assertion, the same as any other passkey-based login.

Device trust (mobile)

The mobile app enforces a device-approval step before a new device can access your vault, to make it harder for a stolen refresh token alone to be used from an unrecognised device.

What this means if our servers are compromised

An attacker with full access to our database would obtain: encrypted vault ciphertext, salted password-verification hashes, account metadata (email, item types, timestamps), and audit logs. They would not obtain your master password or a readable copy of any credential in your vault — decrypting either requires your master password, which we never had.

Reporting a vulnerability

If you believe you've found a security issue in Secure Pass, please report it to support@securepassvault.app rather than filing a public issue. We ask that you give us a reasonable window to address it before any public disclosure.