Security & Zero-Knowledge Architecture

Your Data Belongs Only to You. And No One Else.

A transparent breakdown of how PassKee encrypts your vault on your device, why our servers are mathematically unable to read your passwords, and how your 128-bit Emergency Secret Key protects you.

01 • Principle of Complete Privacy

We Cannot Read Your Passwords. And That Is by Design.

PassKee is built on strict Zero-Knowledge end-to-end encryption. Your logins, cards, SSH keys, database credentials, and notes are encrypted and decrypted exclusively inside your browser. Data arrives on our servers as raw binary ciphertext (bytea) for which we never hold the key.

Argon2id Client KDF

Your browser combines your Master Password and 128-bit Emergency Secret Key with your 32-byte salt using Argon2id to derive a 256-bit Master Key in RAM.

Zero-Leak Authentication

Your Master Key never leaves your device. To authenticate, the client computes HMAC-SHA256(MasterKey, "auth_login"), which the server hashes a second time with Argon2id.

X25519 + AES-256-GCM

Each user has a Curve25519 (X25519) keypair and a 256-bit Vault Key encrypted with AES-256-GCM. Every vault key is wrapped via ephemeral ECDH + AES-256-GCM with 12-byte random nonces.

15-Minute RAM Zeroing

After 15 minutes of inactivity—or when you click Lock—PassKee executes CryptographicOperations.ZeroMemory on your Private Key and Vault Key in RAM.

02 • Two-Key Protection Model

How Your Emergency Secret Key Protects New Devices

When you create a PassKee account, your browser generates a high-entropy 128-bit Emergency Secret Key alongside your Master Password. Together, they form a mathematical dual lock:

1 Sign In on a New Device (Sign In to PassKee): Requires your Email Address, Master Password, and your 128-bit Emergency Secret Key (PK-XXXX-...). Even if someone steals your password via phishing, they cannot sign in from their device without your Secret Key.
2 Quick Unlock in Active Session (Unlock Session): When signing in, check "Remember Secret Key for quick unlock in this session". PassKee encrypts your Secret Key in isolated sessionStorage using Argon2id, so unlocking after a 15-minute inactivity lock requires only your Master Password.

GET STARTED

Create PassKee Account

Save Your Emergency Secret Key

PassKee has generated your unique Emergency Secret Key on this device. You will need both your Master Password and this Secret Key to sign in.

PK-NFT6-G4F7-LNRY-TJPU-V7GV-8K2M

Copy Secret Key

Keep this safe! PassKee cannot recover or reset your Secret Key. If lost, your vault cannot be unlocked on new devices.

I have saved my Secret Key and understand PassKee cannot recover it.

Continue to Sign In

03 • No Remote Reset & Risk Management

Why PassKee Has No "Forgot Password" Button

If a service can reset your password by sending an email link, it holds the ability to access your account without your keys. Because PassKee is zero-knowledge and never stores your Master Password or Emergency Secret Key, we cannot reset your credentials or recover a locked vault remotely.

Scenario A Full Access

Signing In on a New Device

Enter your Email, Master Password, and the PK-XXXX-... Emergency Secret Key you copied during registration to decrypt your vault immediately.

Scenario B Backup via KDBX

Lost Secret Key, Active Session Open

If you still have an unlocked session on an authorized device, open Vault Actions (⋮) → Backup (Export to KeePass .kdbx), then register a new account and import that .kdbx file.

Scenario C Unrecoverable

Lost Password or Key With No Active Session

If you lose your Master Password or your Emergency Secret Key and have no signed-in device to export a backup, your encrypted vault remains permanently unreadable.

3 Practical Ways to Safeguard Your Emergency Secret Key & Vault

Store offline right after sign-up: Write down or print your PK-XXXX-... Secret Key and keep it in a physical safe or locked drawer.
Keep periodic .kdbx backups: Use Backup → Export to KeePass (.kdbx) to save an encrypted KDBX 4 snapshot on an offline USB drive.
Keep both factors separate: Never store your Master Password and Emergency Secret Key together in an unencrypted note or email.