Specifications
The technical details
What Riftgate runs on, how it encrypts, and what the sync server stores.
Cryptography
- Key derivation
- Argon2id, 64 MiB–2 GiB memory, 3+ iterations (client-enforced floors)
- Entry encryption
- AES-256-GCM, per-entry nonce, entry id bound as associated data
- Server knowledge
- None: login uses a derived auth key, the vault key never leaves your devices
- Two-factor
- TOTP with replay protection
- Transport
- TLS 1.2+ everywhere; RDP, SFTP and FTPS certificates pinned on first use
Platforms
- Windows
- Windows 10 / 11, x64 and ARM64
- macOS
- macOS 13 or newer, Apple Silicon and Intel
- Linux
- x64 and ARM64 (glibc), X11 or Wayland
- Browser
- Web vault in any modern browser
Sync server
- Hosting
- Managed by Riftgate, or self-host with Docker Compose
- Storage
- PostgreSQL, ciphertext only
- Sessions
- Short-lived access tokens, rotating refresh tokens
- Abuse protection
- Rate limiting and login throttling