How encryption works

Your vault is encrypted on your device before it is saved. KeyValt’s servers only ever receive scrambled data (ciphertext) that they have no key to unscramble.

1. Your master password is turned into a strong key on your device using Argon2id, a deliberately slow and memory-hard algorithm that makes guessing expensive.
2. That key unlocks your vault key. Every portal and account has its own item key, wrapped by the vault key.
3. Items are encrypted with AES-256-GCM, which also detects tampering.
4. To sign in, your device sends a separate value derived from the master password — not the password itself — which the server hashes again.

What this means for you

• Nobody at KeyValt can view your passwords, even administrators and support staff.
• We can’t reset your master password for you. Keep your recovery kit safe.
• A strong, unique master password is the most important thing you control.