Zero-knowledge, by design
DPVault is built so that only you can read your vault. The server stores your data, syncs it, and backs it up — but it holds no key that can open it. Here is what happens, and where.
Your master password never leaves your device
When you sign in, your device runs your master password through Argon2id to derive your keys locally. The server only ever receives an authentication value that cannot be turned back into your password — and never the password itself.
Your vault is encrypted before it is synced
Every item is sealed on your device with XChaCha20-Poly1305 under a random vault key, which is itself wrapped by the key from your password. What reaches the server is opaque ciphertext. Changing your master password re-wraps that one key — your items are never re-encrypted or exposed.
Sharing without handing over keys
A shared folder's key is sealed individually to each member's public key using X25519 sealed boxes. Only that member's device can open their copy. The server relays the sealed key but can never read it, and neither can anyone the folder was not shared with.
Administration is not access
The admin console manages tenants, users, groups, folders, policies, and single sign-on — but it cannot read anyone's vault. A vault opens only with a key that administrators do not hold. Managing an organisation and reading its secrets are deliberately two different things.
Unlock with a security key or your fingerprint
Add a hardware security key like a YubiKey, or your device's built-in biometric — Face ID, Touch ID, Windows Hello, or a fingerprint reader — as another way to open your vault. It uses the FIDO2 / WebAuthn standard: a secret that never leaves the authenticator wraps a second copy of your vault key, and the server keeps only public handles it cannot use. Your master password still works; this is an additional door, not a replacement — and nothing that can open your vault is ever stored on the server.
Recovery and passwordless, only if your organisation opts in
An organisation can nominate a recovery administrator — members' devices then seal a spare copy of their vault key to that administrator, so a forgotten password can be recovered by a one-time code. It can also allow signing in with single sign-on alone, where an approved device key opens the vault instead of a password. Both are off by default, and turning them on is stated plainly to the people affected.