How PassCryp protects your vault
PassCryp encrypts every vault item on your device with AES-256-GCM — an authenticated encryption mode that detects tampering. Your master password is never transmitted; it derives a vault key locally using Argon2id, a memory-hard KDF designed to defeat modern GPU and ASIC brute-force attacks.
Sync is built on encrypted ciphertext only. Even a full database compromise would expose no plaintext, because the keys live in your head — not on our servers. Per-row Row-Level Security in the database adds a second layer: a misconfigured query physically cannot return another user's ciphertext.
The browser extension is open source so you can audit the code that touches your master password. The core vault architecture is documented in a public security whitepaper, and every dependency that touches cryptography is pinned and reviewed.