How Keyaria protects your data

Security is at the core of Keyaria. Here is a precise, honest explanation of what we do to protect your data, where encryption happens, and what this model protects.

Encryption at rest

Every sensitive field (passwords, secrets, serials) is encrypted with AES-256-GCM before it is stored in the database. GCM provides both confidentiality and integrity, so any tampering with the ciphertext is detected on decryption.

Key separation

The encryption key is not stored in the database. A unique key is derived per user via HKDF from a master key that lives only in the server configuration. The practical result: a database-only leak is not enough to decrypt your data.

In the interest of transparency: Keyaria is not a “zero-knowledge” service — the server holds the master key to power features like the extension and app. Our model protects you from database leaks and from any party without the master key — no more, no less — and we state that honestly.

Account protection

Your login password is stored as a bcrypt hash (high cost factor), and TOTP two-factor authentication is mandatory on every account with recovery codes. Login attempts are rate-limited to prevent guessing, and sign-in activity is logged with an alert on new-device sign-ins.

Secure sharing

Share links open once (or expire by time). The server stores the text encrypted with an independent random key, and the key is placed in the URL fragment (after #) — a part that is never sent to the server or logged, and the decryption happens in the recipient’s browser.

Encrypted backups

Backups are exported encrypted with a passphrase you choose, using PBKDF2-SHA256 (200,000 iterations) for key derivation and then AES-256-GCM. The file cannot be opened without the passphrase, and the same format is compatible between the website and the app.

You stay in control

You can sign out from all devices, verify your email, and permanently delete your account and all its data at any time — everything of yours is wiped from the servers.

Transport & infrastructure

All traffic is over HTTPS with an HSTS header, a strict Content-Security-Policy that limits untrusted script execution, and extra protection headers against framing and content-type sniffing.