Zero-knowledge architecture
Not even we can see your data.
In KeyZula, encryption happens on your device, not on the server. Our servers only store and sync data they can't read.
A key is derived from your master password
Your master password is processed on your device with Argon2id to produce a key. The master password itself is never sent to the server.
Every item is encrypted separately
Each item in your vault has its own random key and is encrypted with XChaCha20-Poly1305. The item name, website and type are part of the encrypted data.
The server only stores ciphertext
The server syncs encrypted data between your devices but cannot read it. Only your device can unlock your vault.
What can the server see?
In the interest of transparency, here is the full list.
| Data | On the server |
|---|---|
| Your master password | Never sent |
| Passwords, passkeys, 2FA secrets, SSH keys, notes and file attachments | Can't see (encrypted) |
| Item names, usernames and website addresses | Can't see (encrypted) |
| Item type (password, card, SSH key…) | Can't see (encrypted) |
| Folder and collection names | Can't see (encrypted) |
| Your email address and name | Visible |
| Number of items and when they were updated | Visible |
| Organization name, members and permissions | Visible |
| Signed-in devices and IP addresses | Visible |
| Which item was opened, copied or autofilled, when and from which device (item ID only, not its name or contents) | Visible |
How does sharing stay secure?
Every user has a public/private key pair. When a collection is shared, its key is encrypted to the recipient's public key so only they can open it. When a new member joins, an admin can compare the member's key fingerprint with them over a separate channel, so a fake key slipped in by the server would be noticed.
If you forget your master password
KeyZula never knows or stores your master password, so it can't reset it. That's the natural consequence of your data belonging only to you. Choose a long, memorable sentence and keep it somewhere safe.
Technical details
Transparency
Review our design yourself
Our security whitepaper explains key derivation, encryption, sharing, sessions and exactly what our server can and cannot see, based on the actual code. Our encryption library is open source, so you can verify our claims.
Secure your keys today.
Create an account in seconds. Completely free, no credit card required.
Get Started Free