Security · Protocol v1

Your data isuntouchable.

Every item encrypted with its own key. Every attack slowed by non-parallelizable puzzles. We can’t read your data — and neither can anyone else.

Key derivation hierarchy4 layers
  1. 01
    Master password
    PBKDF2 · 600k iterations
  2. 02
    Key encryption key
    AES-256 key wrapping
  3. 03
    Vault data key
    One per vault
  4. 04
    Per-item key
    AES-256-GCM · unique to every item

· All keys derived client-side · Server sees only encrypted blobs

AES-256
Authenticated encryption
4 layers
Key hierarchy
101 s
Per-guess cost
0 bytes
We can read

Encryption protocol

Multi-layer
protection.

Every security decision in FoxVault is designed to minimize trust and maximize isolation.

01

Encryption at every level

Your password never leaves your device. Every vault has its own key. Every item within has its own unique key. We can’t decrypt anything — even if we wanted to.

4 layers
of key isolation per item
02

Hardened against modern attacks

Trapdoor-delay AEAD makes each item cost 200ms to crack — and that cost can’t be reduced with more hardware. Your vault size makes it harder. The more items you have, the safer you are.

16M ×
asymmetry per item
03

Defense in depth

Keys live in an isolated Web Worker immune to XSS. Sensitive items require a PIN or hardware key. Every access is logged in a tamper-evident chain. We detect if anyone modifies your data on the server.

6 layers
of defense beyond encryption

Hardening layers

5 layers of cost.

Every password guess costs an attacker 101 seconds of sequential computation. Throwing more hardware at it doesn’t help.

Key derivation200ms
Memory-hard entanglement500ms
Time-lock puzzle100s

· 101s per guess · 500× standard vault · +9 bits free entropy

Trust boundary

What lives where.

Sensitive material never crosses the boundary. The server stores only what an attacker is allowed to see.

Trusted · Your device
  • Web Worker
  • Secret key
  • Merkle root
  • Master password
  • Decrypted items
  • Vault DEK
Untrusted · Server
  • Encrypted blobs
  • Audit chain
  • Blind index
  • Public metadata

Practices

Security beyond encryption.

Encryption is just the start. Here’s how we protect your privacy at every level.

01

No tracking

No third-party analytics, no tracking pixels, no fingerprinting. We don't know how you use FoxVault — and we don't want to.
02

Nothing on our servers

Our servers only store encrypted blobs. No plaintext passwords, keys, or personal data ever touches our infrastructure.
03

Minimal data

We store your email for sign-in and your encrypted vault. That’s it. No names, no addresses, no payment info unless you upgrade.
04

Works offline

Your vault is cached encrypted on your device. Access passwords and 2FA codes even without internet — it syncs when you reconnect.
05

Auto-lock

Your vault locks automatically after inactivity. All encryption keys are wiped from memory — a page reload requires re-authentication.
06

Account isolation

Every user’s data is isolated via database row-level security. Audit chain entries are append-only — no UPDATE or DELETE policies exist.
Whitepaper

The full security model.

Complete documentation covering the cryptographic protocol, threat model, key lifecycle, and architectural decisions.

Read the whitepaper
Responsible disclosure

Report a vulnerability.

Found something? We take every report seriously. Please disclose responsibly and we’ll respond within 24 hours.

security@foxvault.net

Encryption you
don’t have to trust.

Free forever for individuals. No credit card required.

Get startedSee pricing