A Password Vault We Can Never Read.
VaultKey encrypts every password in your browser with AES-256-GCM and Argon2id before it ever leaves your device. Our servers only hold ciphertext—your Master Password remains the sole key that opens your vault.
ct: YWVzX2djbV8yNTY6azcjVnEhMm1acDkkTHg0UjpzaWdu==
Even if our database is leaked, zero plaintext can be read without your Master Password.
Engineered For Complete Mathematical Privacy
Every design decision prioritizes cryptographic safety over convenience. Your secrets are protected by state-of-the-art standards.
Client-Side WebAssembly Cryptographic Engine
Every vault item is encrypted in browser memory using AES-256-GCM and Argon2id WebAssembly before hitting the network. Keys are non-extractable and never written to browser storage.
Independent Master Password
Your sign-in password and your vault encryption key are mathematically independent. Your Master Password is never transmitted over the internet.
Cryptographic Generator
Create high-entropy passwords and memorable Diceware passphrases generated with hardware entropy.
Enforced 2FA Protection
Protect account operations with standard authenticator apps. Database RLS locks vault queries until AAL2 verification is settled.
Auto-Lock & Clipboard Clear
Locks instantly on inactivity or tab switching. Automatically clears sensitive copied passwords from system clipboard.
Encrypted Portable Backups
Export an encrypted JSON snapshot protected by its own Argon2id backup key. Restore anytime to any account without overwriting existing records.
How Your Data Travels: Plaintext Never Leaves
Traditional password managers encrypt on their servers or send keys over the wire. VaultKey never lets plaintext leave your device.
You Enter Secrets Locally
Your website accounts, credentials, and notes are held in volatile RAM memory. Plaintext is never written to disk or sent across the network.
Argon2id + AES-256 Seal
Your browser derives your Key Encryption Key using Argon2id, seals secrets with AES-256-GCM, and attaches fresh cryptographic IVs.
Ciphertext Stored In Cloud
Only scrambled encrypted noise reaches the cloud database. Even with complete database access, no one can decrypt records without your Master Password.
Security Without Compromises or False Claims
True zero-knowledge means we do not possess any backdoor to your vault. Here is what that means in practice.
Frequently Asked Questions
What happens if I forget my Master Password?
Because VaultKey is strictly zero-knowledge, no one—not even our database administrators—holds your Master Password or keys. A forgotten Master Password cannot be reset or recovered. We strongly recommend exporting an encrypted backup file during vault setup.
Can VaultKey employees or hackers see my passwords?
No. All encryption happens inside your web browser before data travels over the internet. The database only ever receives encrypted ciphertext and random IVs. Without your Master Password, those strings are mathematically indistinguishable from random noise.
Can I install VaultKey on my mobile phone?
Yes! VaultKey is a full Progressive Web App (PWA). On Android, open the site in Chrome and tap 'Install App'. On iOS, open Safari, tap the Share button, and select 'Add to Home Screen' for a full native app experience.
Does VaultKey work with two-factor authentication (2FA)?
Yes. You can enroll any standard TOTP authenticator app (Google Authenticator, Apple Passwords, Authy, YubiKey). VaultKey enforces Authenticator Assurance Level 2 (AAL2) at both the application and database policy layers.
Start with an empty vault and a key only you hold.
Join VaultKey today. Free forever for personal use, completely zero-knowledge, and accessible from any browser or phone as a Progressive Web App.