ZK Vault

Security & Cryptographic Architecture

Back to Vault

Our Security Architecture

At ZK Vault, we believe privacy is a fundamental right. We operate under a strict zero-knowledge model: your master password never leaves your browser, and your credentials are encrypted before they ever reach our servers. Your trust is protected by mathematical certainty, not just promises.

1. Local Key Derivation

Why it exists: To ensure your master password is never sent to our servers or exposed in transit.

Instead of sending your password to authenticate, your device performs local password stretching. It derives a Key Encryption Key (KEK) to encrypt your vault locally, and a separate verification hash to prove your identity to the server.

  • Method: PBKDF2-HMAC-SHA256 (100,000 iterations)
  • Salt: Unique, cryptographically random salt derived from your username

2. Client-Side Vault Encryption

Why it exists: To protect your credentials from unauthorized access—even in the event of a total server breach.

Every username, password, URL, and secure note is sealed locally in your browser before transport. The server only receives and stores unreadable ciphertext blocks.

  • Encryption Standard: AES-GCM (256-bit key) using Web Crypto API
  • Integrity: Sealed with unique Initialization Vectors (IV) and a 128-bit authentication tag to prevent data tampering

3. Server-Blind Emergency Recovery

Why it exists: To enable account recovery without backdoor access.

Because we cannot reset your master password, we provide a secure self-custody recovery mechanism. A locally generated recovery key wraps your vault key. The server only stores a hash of the recovery identifier to validate your recovery request.

  • Key Derivation: HKDF-SHA256 from a 256-bit high-entropy random recovery phrase
  • Verification Hash: Hashed via SHA-256 for server authentication

4. Server Infrastructure & Multi-Factor Security

Why it exists: To defend your account against brute-force attacks and session hijacking.

Even though our server cannot read your credentials, we use modern authentication hashing to protect login requests. Active sessions are secured using isolated server session states and secure cookies.

  • Server Hashing: Argon2id (memory-hard, GPU-resistant hashing)
  • Session Protection: HttpOnly, secure, SameSite cookies with SHA-256 hashed identifiers
  • Multi-Factor Safety: Mandatory Time-Based One-Time Passwords (TOTP)

ZK Vault is built entirely on open, industry-standard cryptography. By employing a true zero-knowledge architecture, we ensure your digital life is protected by mathematical certainty—not just promises.

Return to sign in page