How Lockvero keeps your vault unreadable — even to us
A plain-language overview of our architecture. The full technical design is published in our repository documentation.
The key hierarchy
When you create an account, your browser — not our server — does the cryptography:
- Master key. Your master password is stretched with Argon2id (64 MiB of memory, 3 passes) and a random salt. This makes every guess slow and expensive for an attacker.
- Two separate keys. From the master key, HKDF-SHA-256 derives an encryption key that never leaves your device, and an authentication key that proves who you are. The server hashes the authentication key again with Argon2id before storing it.
- Vault key. A random 256-bit key encrypts your vault. It is stored only wrapped — encrypted with your encryption key — and a second copy is wrapped with your recovery key.
- Every item. Projects and logins are encrypted with AES-256-GCM, a fresh random nonce each time, and associated data that binds each ciphertext to its item and project. Swapping or tampering is detected.
What a database thief would get
| Data | Stored as |
|---|---|
| Project names, titles, URLs, emails, usernames, passwords, PINs, notes | AES-256-GCM ciphertext |
| Master password | Never stored or sent |
| Vault key | Encrypted (twice: master-derived key and recovery key) |
| Email address, timestamps, number of items | Plain metadata |
The only way into a stolen vault is to guess the master password — offline, one expensive Argon2id computation per guess. That is why Lockvero requires a long master password and checks its strength before you can use it.
Layers on the server
- Row-level security in PostgreSQL isolates every account at the database itself, as a second line behind the application code.
- Two-factor authentication with passkeys (WebAuthn) or TOTP, with replay protection.
- Brute-force protection: per-account lockout and rate limits, identical answers for every failure.
- Append-only audit log and email alerts for sign-ins from new browsers and security changes.
- Encrypted backups, so even our backups are not readable without a key kept offline.
The web app itself
A web-based password manager is only as trustworthy as the code it loads. Lockvero serves its app with a strict Content-Security-Policy and Trusted Types (no inline or third-party scripts), from a different origin than the API. The browser extension is installed once from the store, which removes the need to trust a fresh download on every visit.
Sharing without trusting us
Each account has a P-256 key pair created in the browser. A shared project gets its own key, encrypted separately to each member’s public key. You can compare a short security code with the other person to make sure the key really is theirs. Removing a member rotates the project key.
What we cannot do
We cannot see your passwords, reset your master password, or recover your vault if you lose both your master password and recovery key. These limits are deliberate: anything we could do for you, an attacker who took over our servers could do too.
Report a vulnerability
Email security@lockvero.com. We welcome responsible disclosure and will respond quickly.
Your vault, encrypted before it leaves your device
Free forever plan. No card required.
Create your free vault