lock
Client-side encryption
Vault entries are encrypted with AES-256-GCM using a key derived from your master password via PBKDF2. Encryption and decryption happen entirely in your browser.
Everything you need to secure your credentials.
Every feature is built around one rule: your vault is encrypted on your device, so we never hold the keys to your data.
sync_lock
Encrypted sync
Your encrypted vault syncs across every device you sign in on. Only ciphertext is transmitted and stored — plain text never leaves your browser.
group
Shared vaults
Share credentials with teammates using ECDH P-256 key exchange. The vault key is wrapped individually for each member, so access is granted per person and can be revoked.
password
Two-factor authentication
Add TOTP-based 2FA from any authenticator app, or receive codes by email. 2FA protects sign-in on top of client-side encryption.
health_and_safety
Password health
Surface weak, reused, and old passwords with an on-device health score, so you know exactly what to fix first.
travel_explore
Breach monitoring
Check your passwords against known breaches using k-anonymity — only a partial, non-reversible hash prefix is ever sent.
auto_awesome
Strong password generator
Generate high-entropy passwords with cryptographically secure randomness and unbiased character selection.
history
Activity logs
Review a clear, timestamped log of security-relevant actions such as sign-ins, vault unlocks, and exports.
install_mobile
Installable web app
Install ZeroVault as a Progressive Web App for a native-like experience. The PWA caches the app shell for faster loading — your vault still syncs from the server.
Start for free
arrow_forward
Want the cryptographic details? Read the security overview.