What is a Zero-Knowledge Password Manager?

Every year brings new breach headlines: LastPass, Okta, 23andMe, and dozens of smaller providers. Most are not catastrophic because attackers stole data — they're catastrophic because the data was decryptable once stolen. Zero-knowledge architecture changes that equation: if the server never holds the key, a stolen database is just noise.

Zero-knowledge is also a hedge against compelled disclosure. A provider that can decrypt your data can be ordered to. A provider that cannot — and can prove it cannot — has nothing to hand over. PassCryp publishes its key-derivation parameters and threat model so this claim is verifiable, not just marketing.

It also defends against insider risk. PassCryp engineers do not have a tool that reads your vault. There is no "god mode" admin panel. The architecture makes the wrong thing impossible, not just policy-forbidden.

When you set a master password, PassCryp generates a random 256-bit vault key and encrypts it with a key derived from your master password using Argon2id (64 MB memory cost, 3 iterations, parallelism 1 — tuned to the OWASP 2024 recommendation). The result is your wrapped vault key, the only thing we store that depends on your master password.

Every vault item — passwords, notes, API keys, TOTP seeds, card numbers — is encrypted client-side with AES-256-GCM using a fresh 96-bit nonce. Ciphertext, nonce, and the GCM auth tag are all that sync. The plaintext exists only in the memory of devices you've unlocked.

Sharing works without us ever holding the key: shared vaults use a per-vault key encrypted to each member's public key. Revoking a member rotates the vault key and re-encrypts items, all client-side.

The trade for zero-knowledge is genuine: if you lose your master password and your recovery kit, your vault is unrecoverable. PassCryp's recovery kit is a one-page PDF you print at signup and store offline; it contains an encrypted recovery key that lets you reset without us ever seeing your master password.

What you keep is everything else: sync across devices, browser autofill, TOTP, breach checks, password generation, secure notes, API key storage, and the credit card vault. The crypto sits underneath; the UX is just a password manager.