How PassCryp Works

Your browser generates a random 256-bit vault key. PassCryp derives a wrapping key from your master password using Argon2id with 64 MB memory cost, 3 iterations, and parallelism 1 — the OWASP 2024 recommendation. The vault key is encrypted with the wrapping key and stored on our servers as an opaque blob. Your master password itself is never sent.

When you unlock on a new device, you re-enter your master password, Argon2id re-derives the wrapping key locally, and the blob is decrypted in your browser. The unwrapped vault key sits in memory only for the duration of your session.

Every vault item is encrypted in your browser before it touches the network. Item titles, URLs, passwords, notes, TOTP seeds — all wrapped with AES-256-GCM using a fresh nonce per item. Realtime sync uses Postgres change streams, but the payloads on the wire are ciphertext + nonce + authentication tag. A subscribing device decrypts locally.

Even the database can't see your plaintext: per-row Row-Level Security ensures one user's encrypted rows are never visible to another, and the rows themselves are encrypted anyway.

You visit a site. The extension detects the login form, matches the domain against your vault, and offers to fill. One click, you're in. If the site uses 2FA, the TOTP code is right there — copy-to-clipboard with 30-second auto-clear.

You sign up for a new service. The extension offers to generate a strong password (20 random characters with full symbol set). You accept, submit the form, and the extension saves the credential to your vault automatically.

You travel. Same vault, same items, same TOTP codes on every device you've ever signed into PassCryp on. Revoke any device from Settings if it gets lost.