Security
No server means no server to breach. Here’s how Vaultyn protects your data — and what it can’t do.
Your data stays with you
Vaultyn has no account system and no server that holds your data. Everything you record is encrypted and stored only on your Mac and in a folder you choose (for example iCloud Drive). We can’t see your data and have no way to.
How it’s encrypted
| Layer | How |
|---|---|
| Master password → key | Argon2id (64 MB of memory, 3 passes) turns your master password into a key-encryption key. Every guess is slow and memory-hungry, making brute force very hard |
| Vault key | A random 256-bit key encrypts all data; it is itself stored encrypted by the key derived from your master password |
| Data | AES-256-GCM, which also detects tampering |
| Recovery key | A 160-bit random value, run through HKDF to make a second key that wraps the same vault key, so you can reset a forgotten master password |
| Attachments and icons | Also encrypted with AES-256-GCM; file names are random IDs that reveal nothing |
Because of this design, changing your master password only re-wraps the vault key instead of re-encrypting everything, and a forgotten master password can be reset with the recovery key.
Protection while you use it
- Locks automatically after a period of inactivity, and when your Mac locks or sleeps
- Copied passwords are cleared from the clipboard after a set time
- Unlock with Touch ID
- Optional screenshot protection: the window appears blank in screenshots, recordings and screen sharing
- Add a separate password to any category
- No autofill and nothing injected into web pages, reducing phishing risk
Features that use the network
Vaultyn’s core features work fully offline. These connect only when you use them, and all are optional:
- Password breach check: sends only the first 5 characters of the SHA-1 hash; matching happens on your Mac and the password never leaves it
- Website icons (off by default): sends the website’s domain
- Breached sites and two-factor support lists: public lists are downloaded; none of your data is sent
- Exchange rates (assets feature, off by default): sends only your base currency code
What it can’t do
- If your Mac is already infected with malware (such as a keylogger), no password app can fully protect you
- A weak master password can be guessed no matter how strong the encryption — use a long one
- If both your master password and recovery key are lost, the data can’t be opened — we can’t help either
Report a security issue
Found a vulnerability? Email support@vaultyn.com with “Security” in the subject. We’ll prioritise it — please don’t disclose details before a fix is out.