Security

Cryptography you can trust

Industry-standard encryption with a zero-knowledge architecture. Keys are derived on your device; backups and sync store ciphertext only you can unlock.

Zero-knowledge by design

AzAd Vault never receives your master password or decrypted vault contents. Google Drive sync stores encrypted blobs in your own Drive — we cannot read them even with server access.

  • Argon2id — memory-hard KDF (~64 MB cost) for master password derivation
  • AES-256-GCM — authenticated encryption per field with unique nonces
  • HMAC-SHA256 — backup integrity verification; wrong password fails immediately
  • Secure storage — Android Keystore for session keys; Windows uses OS-protected storage
  • .azvault format — portable encrypted backups; same spec on Android, Windows, and extensions
100

Security score dashboard

A guided checklist walks you through biometrics, backups, imports, and vault hardening — so you always know where you stand.

Data flow

What leaves your device

Only encrypted data transits to Google Drive. Your master password and derived keys never leave local secure storage.

Unlock locally

Master password derives keys on-device via Argon2id. Session key stored in secure hardware/OS storage.

Encrypt fields

Each password, card number, and note encrypted with AES-256-GCM before touching SQLite or memory export.

Sync ciphertext

Google Drive receives encrypted vault blobs in your app folder. AzAd Solutions has no decryption keys.

Verify integrity

HMAC on backups detects tampering. Restore fails fast if password or file is wrong.

Hardening

Built-in protections

Biometric gate

PIN unlock for daily use; biometrics never replace the master password for backup restore.

Auto-lock

Vault locks after inactivity. Re-authentication required before secrets are visible again.

Clipboard timeout

Copied passwords clear from clipboard automatically after a short interval.

Security audit

Detects weak, reused, and expiring passwords. Tracks checklist completion (e.g. 6/8 steps).

No analytics on secrets

Vault contents are never logged or transmitted. See our Privacy Policy for details.

Open crypto stack

Shared vault_core package across all platforms — one implementation, auditable code.

Windows desktop storage

On Windows, your encrypted vault lives at %USERPROFILE%\Documents\AzAd Vault\azad_vault.db. Session keys use Windows DPAPI. Desktop Google sign-in uses OAuth via azadvault.com/oauth/desktop — your Google password is never sent to AzAd Solutions.

Lost master password?

By design, your master password cannot be recovered. If you have an encrypted .azvault backup and remember the password used to create it, you can restore. Otherwise a new vault must be created. This is the trade-off of true zero-knowledge security.