Zero-knowledge architecture
Not even we can see your data.
In KeyZula, encryption happens on your device, not on the server. Our servers only store and sync data they can't read.
A key is derived from your master password
Your master password is processed on your device with Argon2id to produce a key. The master password itself is never sent to the server.
Every item is encrypted separately
Each item in your vault has its own random key and is encrypted with XChaCha20-Poly1305. The item name, website and type are part of the encrypted data.
The server only stores ciphertext
The server syncs encrypted data between your devices but cannot read it. Only your device can unlock your vault.
What can the server see?
In the interest of transparency, here is the full list.
| Data | On the server |
|---|---|
| Your master password | Never sent |
| Passwords, 2FA secrets, SSH keys, notes | Can't see (encrypted) |
| Item names, usernames and website addresses | Can't see (encrypted) |
| Item type (password, card, SSH key…) | Can't see (encrypted) |
| Folder and collection names | Can't see (encrypted) |
| Your email address and name | Visible |
| Number of items and when they were updated | Visible |
| Organization name, members and permissions | Visible |
| Signed-in devices and IP addresses | Visible |
How does sharing stay secure?
Every user has a public/private key pair. When a collection is shared, its key is encrypted to the recipient's public key so only they can open it. When a new member joins, an admin compares the member's key fingerprint with them over a separate channel. This prevents the server from slipping in a fake key.
If you forget your master password
KeyZula never knows or stores your master password, so it can't reset it. That's the natural consequence of your data belonging only to you. Choose a long, memorable sentence and keep it somewhere safe.
Technical details
Secure your keys today.
Create an account in seconds. Completely free, no credit card required.
Get Started Free