Skip to main content

Use arrow keys to navigate, Enter to select, Escape to close menu.

ZeyroVault

Security

A plain account of what the browser tools defend against, and what they do not.

Last updated: October 2026

The short version

ZeyroVault derives every encryption key from your passphrase inside your browser. The key never leaves the device, so a server cannot read your plaintext or your key, and nothing is kept for later.

What this protects against

  • Storage that keeps your data in the clear.
  • A service operator reading your plaintext or your key.
  • Interception of data that would otherwise travel in readable form.

What this does not protect against

Client-side encryption protects data at rest and in transit. It cannot protect a device that an attacker already controls.

  • Malware or a keylogger on the device you use.
  • Anyone who watches your screen or reads your clipboard.
  • A hostile browser extension with access to the page.
  • A weak, reused or lost passphrase.
  • Metadata such as file size and the time of an operation.

Standards

  • AES-256-GCM for encryption, per NIST SP 800-38D and FIPS 197.
  • PBKDF2-HMAC-SHA-256 for key derivation, per RFC 8018, and SHA-256 for hashing.
  • No account, and no upload of plaintext or keys.

Reporting a security issue

Please report suspected issues by writing to [email protected]. A machine-readable contact block is published at https://zeyrovault.com/.well-known/security.txt.

Where your data goes

The tools run as static files in your browser. There is no application server that receives your input, so the data flow has fewer steps than a hosted editor.

  • Step 1: you open the page; Cloudflare serves static HTML, CSS and JavaScript.
  • Step 2: you type or select a file; the input stays in browser memory.
  • Step 3: Web Crypto derives a key and encrypts locally; the result stays on your device until you download or copy it.
  • Step 4: you share the output yourself; the recipient needs the passphrase, and no server holds a copy.

Verify the boundary yourself

Five minutes with the browser you already use is enough to test the main claim.

  • Open DevTools and switch to the Network tab before you encrypt a test note.
  • Confirm that no request body contains the note, the passphrase or the key.
  • Disconnect the network and repeat the operation; the tool still works because the code is already loaded.
  • Open the Application tab and check that the note is not in localStorage, sessionStorage or IndexedDB. The tools store preferences and cached app files, not your input.
Read the security model