Riftgate
Security

Zero knowledge, explained

Your vault is encrypted before it leaves your device. Here is exactly how.

  1. 1

    You type your master password

    It never leaves the device, and is never stored.

  2. 2

    Argon2id derives two keys

    A vault key that encrypts your entries, and a separate auth key used only to sign in.

  3. 3

    Entries are sealed locally

    Each entry is encrypted with AES-256-GCM and bound to its id, so blobs can't be swapped between entries.

  4. 4

    Only ciphertext is synced

    The server stores encrypted blobs and a hash of the auth key. It cannot decrypt anything.

Also built in

  • Two-factor authentication (TOTP) with replay protection; changing it requires your password and a current code.
  • Login throttling and rate limits on the sync server; refresh tokens rotate and are single-use.
  • Quick unlock keeps the vault key in the OS secret store (Windows Hello / DPAPI, macOS Keychain, Linux Secret Service), never in plain files.
  • Copied passwords are excluded from clipboard history and cloud clipboard, and cleared automatically.
  • Server certificates and host keys are pinned on first use; a change stops the connection before credentials are sent.