How HexVault Protects Your Passwords

01/Overview

02/Encryption standard

All vault data is encrypted using AES-256-GCM (Advanced Encryption Standard, 256-bit key, Galois/Counter Mode). GCM provides both confidentiality and authenticity — it detects if ciphertext has been tampered with, in addition to keeping the plaintext secret.

Each vault entry is encrypted independently with its own random 96-bit initialisation vector (IV). This means that even if two entries have identical content, their ciphertext will be different.

03/Key derivation

Your master password is never transmitted to our servers. Instead, it is used to derive an encryption key locally in your browser:

We use PBKDF2 (Password-Based Key Derivation Function 2) with 250,000 iterations and SHA-256. The high iteration count makes brute-force attacks computationally expensive. A unique random salt is generated per account and stored alongside the ciphertext.

The derived encryption key exists only in memory during your session. It is never written to disk, never transmitted over the network, and is discarded when you lock your vault or close the tab.

04/Vault entry encryption

Every vault entry — password, username, URL, notes — is encrypted as a single JSON object before transmission:

What we store in our database is { ciphertext, iv }. Without the encryption key — which only exists in your browser — this data is meaningless.

05/Breach monitoring

HexVault checks your passwords against the Have I Been Pwned database of billions of compromised credentials. This is done using the k-anonymity model:

• Your password is hashed locally using SHA-1
• Only the first 5 characters of that hash are sent to the HIBP API
• The API returns all hash suffixes matching those 5 characters (typically hundreds)
• Your browser checks locally whether your full hash appears in the returned list
• Your actual password never leaves your device

06/Transport security

All traffic between your browser and HexVault's servers is encrypted using TLS 1.2 or higher. HTTP requests are automatically redirected to HTTPS. HexVault enforces HSTS (HTTP Strict Transport Security) to prevent downgrade attacks.

Traffic is proxied through Cloudflare, which provides additional DDoS protection and terminates TLS at the edge. The connection from Cloudflare to our origin server is also encrypted.

07/Infrastructure

• Application servers run in isolated Docker containers
• The database is not publicly accessible — only reachable from the application container on an internal network
• Encrypted backups are taken automatically
• No plaintext password data ever touches our infrastructure
• Security headers are set on all responses: CSP, HSTS, X-Frame-Options, X-Content-Type-Options

08/Two-factor authentication

HexVault supports TOTP (Time-based One-Time Password) two-factor authentication, compatible with any standard authenticator app. We strongly recommend enabling 2FA on your account.

2FA protects against unauthorised access even if your email and password are compromised. It does not affect the zero-knowledge encryption of your vault — your master password remains the sole decryption key.

09/Session security

• Auto-lock. Vault automatically locks after a configurable period of inactivity. The encryption key is discarded from memory on lock.
• Trusted devices. New device logins trigger a security notification email.
• Session tokens. Authenticated sessions use secure, httpOnly cookies. Session tokens are rotated on each login.
• Concurrent sessions. You can view and revoke active sessions from account settings.

10/Audit & responsible disclosure

We welcome responsible disclosure of security vulnerabilities. If you find an issue, please contact us before public disclosure to give us time to investigate and fix it.