Security you can check
Your vault is encrypted in your browser before it reaches us. Here is how it works, and what we can and cannot see
In your browser
What our server stores
- Name
e2ee.v1:…- Username
e2ee.v1:…- Password
e2ee.v1:…
One key opens your vault
Your entries are encrypted with a random vault key. We only ever store that key wrapped, locked under keys that only you hold.
Your master password, your recovery key, a passkey or an emergency contact can each unwrap the vault key, and the vault key encrypts your entries.
Signing in
Your browser derives a key from your master password with PBKDF2 and 600,000 iterations, unwraps the vault key with it and decrypts your entries on your device.
Unlocking with a passkey
A passkey that supports the WebAuthn PRF extension gives your browser a secret of its own, which unwraps a copy of the vault key made for that passkey. Passkeys without PRF still sign you in, and your vault then asks for your master password.
Getting back in
A password reset only changes how you sign in. Your recovery key unwraps its own copy of the vault key, and your browser then wraps it again under your new password. Without the recovery key, nobody can open the vault, us included.
A trusted contact
When you add a contact, your browser encrypts the vault key for their public key. Our server hands it over only when you approve their request, or once your wait time passes without you rejecting it. They can read your vault, not change it.
- Encryption
- AES-256-GCM, with a fresh 96-bit IV for every value
- Key derivation
- PBKDF2-SHA256, 600,000 iterations, a random 16-byte salt
- Vault key
- 256 random bits, stored by us only in wrapped form
- Who can unwrap it
- Your master password, your 160-bit recovery key, each passkey with PRF and, for emergency access, your contact's public key
- Shared entries
- A 256-bit key per entry, wrapped for each person with RSA-OAEP 2048 and SHA-256
- Secure Send
- A 256-bit link key in the address, turned into an AES-256-GCM key with HKDF-SHA256, and an optional password through PBKDF2-SHA256 at 600,000 iterations
Layers around your account
Encryption keeps your vault private. These keep other people out of your account.
-
Your master password
You sign in with your master password over an encrypted connection. Our server checks it against a hash and never stores the password itself. It has to be at least 16 characters, and repeated wrong attempts are limited.
-
Two-factor authentication from the start
Every account sets up an authenticator app before it can open the vault. Each 6-digit code works once, and eight single-use backup codes cover a lost phone. The secrets behind your codes are encrypted on our servers too.
-
Passkeys
Sign in with a passkey instead of typing your master password. Adding or removing one asks for your master password first.
-
A check for new locations
A sign-in from a different country, or a different network when no country is known, waits until you confirm it from a link we email you. The link works for one hour.
-
Your devices and sessions
Your profile lists every signed-in browser and extension. Sign one out, or all the others at once. Changing or resetting your password ends your other sessions.
-
Your master password, again
Exporting your vault, changing your password or email, adding a passkey or an emergency contact and deleting your account all ask for your master password again.
What we can and cannot see
End-to-end encryption protects what is in your vault. Some information still reaches us, because Sycryptic cannot work without it.
We cannot
- Read your passwords, notes, recovery codes or tag names.
- Open your vault with a password reset. Only your recovery key can.
- See the key that encrypts your vault, or your recovery key.
- See which of your passwords are weak, reused or breached. Those checks run in your browser.
We can
- See your email address and username, and when and from which IP address and country you sign in.
- See when entries are created, changed or deleted, which are favorites, which entries carry tags (though not which ones) and how a login's web address is matched, but not their names.
- See the icon images you upload for entries, which are stored unencrypted.
- Receive your master password when you sign in, over an encrypted connection, to check it against its hash.
On your own device: once you unlock your vault, your browser keeps its key while you use Sycryptic. Your vault locks itself after a time you choose, and you can lock it yourself at any time. Use Sycryptic on devices you trust, and sign out on shared ones.
More safeguards
How sharing, emergency access, the extension and the checks on your passwords fit in
-
Sharing
Sharing a password moves it to a key of its own, which is encrypted for each person you add with their public key. Only the owner can share. When you stop sharing, they lose access, but what they have already seen stays seen, so change the password if that matters.
-
Emergency access
You choose a wait time of 1, 2, 7, 14 or 30 days. When a contact asks for access, you get an email and can reject the request. Taking access back stops them from opening your vault again.
-
Secure Send
A Send is encrypted in your browser with a key that is in its link, after the # sign. Browsers do not send that part to our server. We store the encrypted content with a value derived from the key, which lets us count views and end the Send on time without the key to read it. We see when a Send is made and opened, its size and its limits, not its text or file name. Revoking stops the link, but cannot take back what was already copied or downloaded.
-
The browser extension
It signs in like the website, two-factor authentication included, and our server gives it only your encrypted vault and your wrapped keys. It shows up in your devices list, and signing it out there ends its access.
-
Password health
Weak and reused passwords are found in your browser. For breaches, only the first five characters of each password's SHA-1 hash go to our server, which asks Have I Been Pwned for every hash that starts with them.
-
Breach monitoring
Once a week, the email address of your account is checked against known breaches with XposedOrNot. It is on by default, and turning it off deletes what it found.
-
The website itself
Every page sends a strict Content Security Policy, so only the scripts we ship run, and forms are protected against cross-site requests. Other sites cannot frame our pages, and the connection is always HTTPS.
Good habits we recommend
- Choose a long, unique master password, and keep two-factor authentication on.
- Back up with an encrypted export. The passphrase-protected one opens in any Sycryptic vault.
- Treat CSV exports as plain text and store them carefully.
- Rotate weak or reused passwords surfaced by your dashboard health score.
- Sign out of devices you no longer use from your profile settings.
- Keep your recovery key somewhere safe and offline. It is the only way back into your vault if you forget your master password.
Ready to put this into practice?
Create a free account and explore the vault dashboard, password health tools, and account security settings