Security
SafePass is designed so the sync server cannot read your data, even if it is breached. This page explains how that works and what the protection does not cover.
Principles
The server is not trusted
The API and database never receive plaintext entries or the vault key. They store ciphertext, revision links and OPAQUE sign-in data.
Your password is never sent
Sign-in uses OPAQUE (RFC 9807): the server verifies your password without receiving it or storing anything that reveals it without guessing.
Every revision has its own key
Each revision of an entry gets a separately derived key with a fresh salt and nonce. Swapping an entry, its ID or its revision is detected by the AES-GCM tag.
People resolve conflicts
Sync stores immutable revisions. Two concurrent edits are both kept until you explicitly choose the result.
Cryptography
| Purpose | Algorithm | Parameters |
|---|---|---|
| Key from master password | Argon2id v1.3 | 64 MiB memory, 3 passes, 4 lanes |
| Encrypting entries and keys | AES-256-GCM | Fresh 128-bit salt and 96-bit nonce per revision |
| Per-revision key | HKDF-SHA-256 | Bound to entry and revision IDs |
| Account sign-in | OPAQUE | RFC 9807, password never sent |
| Recovery phrase | BIP-39, Ed25519 | 24 words, 256 bits of entropy |
| Local database | SQLCipher | Key kept in the OS secure storage |
Sessions
- Access token
- 15 minutes, memory only
- Refresh token
- 30 days, rotated on every use
- Device session
- 90 days at most
- Password change or recovery
- Revokes every session
Recovering access
When you create a vault, SafePass shows a 24-word phrase. It opens the vault key on a new device and lets you reset your account password with a signature made by that phrase. If you lose both the master password and the phrase, the data cannot be recovered by us or by anyone else.
What protection does not cover
- An infected or unlocked device: malware, keyloggers or a compromised operating system.
- A weak master password: Argon2id slows guessing down but cannot prevent it.
- The server can withhold data or return an older revision. It cannot read your data or silently alter it.
- Metadata: sync timing, ciphertext size and the account identifier are visible to the server.
Review status
Before release, SafePass still needs on-device parameter benchmarks, review of the native bindings on every platform and an external security audit. Until then, use it with test data only.
Preview. SafePass is under development and has not had an external security audit yet. Store test data only.