Security, in plain language
Notes from building a zero-knowledge password vault and an authenticator: the decisions behind them, the trade-offs we took, and the parts we would rather you heard from us than found out later.
Every factual claim about another product links to that vendor’s own page, with the date we last read it.
- Migration 6 min read
What happens to your 2FA codes when you switch vaults
Exporting a vault usually exports your two-factor secrets too, in plain text, in the same file as the passwords. Here is what our importer does with them instead, and why.
Read - Plain language 7 min read
What “zero-knowledge” actually means — and how to check it
The phrase is on every vendor’s homepage, ours included. It has a precise meaning, a set of things it does not cover, and four checks you can run without trusting anybody.
Read - Two factors 8 min read
Should your password manager store your 2FA codes?
Every major vault will keep a TOTP secret in the same record as the password it protects. That is genuinely convenient, and it quietly collapses two factors into one.
Read
Try the products the posts are about
A zero-knowledge vault with a free plan, and an authenticator whose codes are free and unlimited.