Your security is our priority
Your vault is encrypted on your device with keys only you hold: your master password and a Secret Key we never see. Not even PassKeep can read it.
- Secret Key, made on your device
- 128-bit
- of memory for every Argon2id guess
- 64 MiB
- XChaCha20-Poly1305 encryption keys
- 256-bit
- passwords we can read
- 0
End-to-end encryption
Everything is encrypted on your device before it leaves it. Our servers only ever hold ciphertext.
A Secret Key only you hold
A 128-bit key made on your device and never sent to us. Even with our servers, nobody can guess your master password.
Your password never leaves your device
We never receive your master password. Signing in uses a separate key derived on your device.
Two-step sign-in
Add a code from an authenticator app for new devices, with one-time recovery codes.
Local-only, if you like
Free for life without an account: your vault stays on your device and never touches a server.
How your vault is protected
You unlock
You type your master password. It never leaves your device.
Your device encrypts
Argon2id stretches it, your Secret Key is mixed in, and every item is sealed on its own.
Only ciphertext syncs
With Premium, encrypted items reach your other devices. We store them, but can’t open them.
Protection, layer by layer
Each layer stands on its own, so a single failure never exposes your vault.
On your device
- Master password stretched with Argon2id (64 MiB, 3 passes) and never stored
- Each item sealed with XChaCha20-Poly1305 and bound to its own ID, so items can’t be swapped
- Attachments encrypted on your device, each with its own key, before upload
- Auto-lock, and copied passwords cleared from the clipboard
- Touch ID, Windows Hello and Linux fingerprint unlock in the desktop app
Your account
- Secret Key and Emergency Kit: a new device needs your master password and your Secret Key
- Two-step sign-in with an authenticator app, and one-time recovery codes
- See every signed-in device and sign any of them out
- Changing your master password signs out every other device
- Strong master passwords required; saved passwords checked privately against known breaches
On our servers
- Vault contents arrive already encrypted, and we can’t decrypt them
- Sign-in data and personal details encrypted again with a server key kept outside the database
- Database encrypted at rest, TLS connections, least-privilege database access
- Encrypted backups whose decryption key is kept offline
- Logs scrubbed of emails and keys, no IP addresses in your security history, and card details handled only by our payment provider
Sharing and emergency access
- Shared items are encrypted to the recipient’s own key
- Compare a security code before you first share, so nobody can slip in their own key
- A changed key is a hard stop, never a silent update
- Emergency contacts get in only after a waiting period you choose, unless you deny it
- The browser extension fills logins only on the site they belong to
What “only you hold the keys” means
PassKeep can’t
- Read your passwords, notes or files
- See your master password or Secret Key
- Reset your master password
- Recover a lost Secret Key
That’s what keeps your vault safe even if our servers were ever breached. It also means only you can get back in.
So please
- Save your Emergency Kit somewhere safe (printed is fine)
- Choose a long master password you don’t use anywhere else
- Turn on two-step sign-in
- Keep an encrypted backup (Settings → Backup)
What encryption can’t protect against
Encryption keeps your vault safe on our servers and on the way to them. While your vault is unlocked, it’s only as safe as the device and browser it’s open in. That’s true of every password manager.
While your vault is unlocked
- Malware on your computer or phone, such as a keylogger, can capture your master password as you type it and anything you open
- A browser extension you install can read the pages you have open, including the web vault while it’s unlocked
- The web vault’s code comes from our website each time you open it, so if that site were ever tampered with, the changed code could read what you unlock there
What helps
- Keep your device, browser and extensions up to date, and install only extensions you trust
- On computers you use every day, prefer the desktop app or the browser extension: their code is installed with the app, not fetched from our site each time
- Lock your vault when you step away (it also locks itself after a while)
- Don’t unlock your vault on shared or public computers
Your data. Always in your control.
Signing in with Google only proves who you are. Your master password and Secret Key still unlock your vault, and Google never sees what’s in it.
Questions? Read the FAQ →