Local Password Manager & Encrypted Vault
This credential vault is separate from the File/Malware/Virus threat vaults. Credential records are encrypted locally with AES-GCM before the encrypted blob is stored in the current browser profile.
Implemented cryptography
The key is derived from the user's master password with PBKDF2-SHA256 using a random 16-byte salt and 250,000 iterations. AES-GCM uses a random 12-byte IV. The master password itself is not stored as a recoverable credential by the vault code.
Credential functions
- Local password-strength and entropy analysis.
- Cryptographic password generation using Web Crypto randomness.
- Optional k-anonymity breach lookup.
- AES-GCM encrypted local credential records.
- User-controlled encrypted vault export/import.
Recovery and synchronisation limits
The credential vault does not provide automatic cloud synchronisation, central account recovery or cross-site browser autofill. Losing the master password can make the encrypted vault contents unrecoverable. Clearing browser storage can remove the locally stored encrypted blob unless you have exported a backup.
Need quarantined files instead? Use the separate File, Malware & Virus Threat Vaults.