Security · Protocol v1

Your data is untouchable

Every item encrypted with its own key. Every attack slowed by non-parallelizable puzzles. We can't read your data — and neither can anyone else.

Master PasswordPBKDF2 · 600k
Secret Keyoptional
KEKKey Encryption Key
Vault DEKPer-vault key
PIKPer-Item Key
Password
2FA Code
Card
All keys isolated in Web Worker — immune to XSS
AES-256
Encryption
4 layers
Key hierarchy
101s
Per guess cost
0 bytes
We can read
Encryption Protocol

Multi-layer protection

Every security decision in FoxVault is designed to minimize trust and maximize isolation.

Encryption at every level

Your password never leaves your device. Every vault has its own key. Every item within has its own unique key. We can't decrypt anything — even if we wanted to.

4 layersof key isolation per item
Password
KEK
DEK
PIK

Hardened against modern attacks

Time-lock puzzles make each item cost 200ms to crack — and that cost can't be reduced with more hardware. Your vault size makes it harder. The more items you have, the safer you are.

16M×asymmetry per item
You (with trapdoor)
~2ms
Attacker (no trapdoor)
~200ms
100× slower · per item · non-parallelizable

Defense in depth

Keys live in an isolated memory space immune to browser attacks. Sensitive items need a PIN or hardware key. Every access is logged in a tamper-proof chain. We detect if anyone modifies your data on the server.

6 layersof defense beyond encryption
Trusted — Your Device
Web Worker
Secret Key
Merkle Root
trust boundary
Untrusted — Server
Encrypted Blobs
Audit Chain
Blind Index
Hardening Layers

5 layers of protection

Every password guess costs an attacker 101 seconds of sequential computation. Throwing more hardware at it doesn't help.

Key Derivation200ms
Memory-Hard Entanglement500ms
Time-Lock Puzzle100s

101s per guess·500× vs standard vault·+9 bits free entropy

Practices

Security beyond encryption

Encryption is just the start. Here's how we protect your privacy at every level.

No tracking

No third-party analytics, no tracking pixels, no fingerprinting. We don't know how you use FoxVault — and we don't want to.

Nothing on our servers

Our servers only store encrypted blobs. No plaintext passwords, keys, or personal data ever touches our infrastructure.

Minimal data

We store your email for sign-in and your encrypted vault. That's it. No names, no addresses, no payment info unless you upgrade.

Works offline

Your vault is cached encrypted on your device. Access passwords and 2FA codes even without internet — it syncs when you reconnect.

Auto-lock

Your vault locks automatically after inactivity. All encryption keys are wiped from memory — a page reload requires re-authentication.

Account isolation

Every user's data is isolated via database row-level security. Audit chain entries are append-only — no UPDATE or DELETE policies exist.

Full Security Model

Our complete security model documentation covers the cryptographic protocol, threat model, key lifecycle, and architectural decisions in detail.

Report a Vulnerability

Found a security issue? We take every report seriously. Please disclose responsibly and we'll respond within 24 hours.

Ready to protect your data?

Join thousands who trust FoxVault with their most sensitive information. Free forever for personal use.

No credit card required