Password Vault

A password manager is only as trustworthy as its architecture. That is why the Passwort-Tresor is built strictly zero-knowledge: every entry is encrypted on your device before it is stored anywhere. Encryption runs through your browser Web Crypto API with AES-256-GCM, and the key is derived from your master password via PBKDF2 with 1,000,000 iterations. Your passwords exist in plain text only in the moment you look at them.

The master password never leaves your device. It is not stored, not transmitted, not hashed and kept anywhere - it is used solely to derive the key locally. The honest flip side: if you forget it, nobody can reset it. No support, no reset link, not even us. That is the whole point of the architecture: what we do not know, we cannot lose or hand over.

In daily use the vault behaves like a tidy desk. Entries have a title, username, password, URL and notes, can be sorted into categories, marked as favorites and searched. The built-in generator creates strong passwords right when you add an entry, removing the classic excuse of not being able to think of one.

The security audit shows you where it hurts: weak passwords, reused passwords and entries that have not been changed in ages. That is how you work off the legacy from the era when the same password with an exclamation mark at the end was used everywhere.

Where the vault lives, honestly: encryption happens in your browser, and exactly that encrypted vault is kept in your account. So it is there in every browser and on every device where you sign in, also after clearing the site data. Your master password and the keys are never sent to us. A regular encrypted backup never hurts, though.

Switching over does not mean starting from zero: CSV exports from LastPass, Bitwarden, KeePass and KeePassXC import directly, multi-line notes included. In the other direction you create an encrypted JSON export as a backup. "Restore backup" loads it again, also in another browser: pick the file, enter the backup master password, then replace or merge. If you keep the backup in the Aktenschrank, only the encrypted file is stored there.

For everyday protection there are the mechanisms you only miss once they are gone: auto-lock after a configurable idle time (5 to 60 minutes or never), and copied passwords are automatically removed from the clipboard after 30 seconds. An open vault on an unattended computer remains a risk though - even the best encryption does not protect against the colleague walking past your unlocked screen.