Security

SafeVault is designed to store and protect your credentials with military-grade encryption. All data is encrypted locally on your device—we never see your passwords or hold your keys.

Military-grade encryption

All passwords are encrypted using AES-256-GCM before storage—the same standard used by banks and government agencies. Encryption is performed on your device with the PointyCastle library; keys are never stored in plain text.

Zero-knowledge architecture

Passwords are encrypted locally before any sync operations. No server can decrypt or access your passwords. Only you possess the decryption keys. When you use local-network sync, data is encrypted end-to-end between your own devices.

Two-factor authentication (2FA)

Add an extra layer beyond your master password. Even if someone gains access to your password, they cannot access your vault without the second authentication factor. SafeVault supports time-based one-time passwords (TOTP) and backup codes.

Biometric unlock

Use Face ID on iOS or Touch ID on supported devices for quick, secure access without typing your master password every time. Biometric data never leaves your device.

Secure platform storage

Encryption keys are stored using platform-specific secure storage: Keychain (iOS/macOS), Windows Credential Manager (Windows), EncryptedSharedPreferences (Android), and secure keyring integration on Linux. Hardware-backed security is used where available.

Auto-lock & clipboard

The vault automatically locks after a period of inactivity. Copied passwords are cleared from the clipboard after a set time to prevent accidental exposure.