Test live in-browser Web Crypto API. Watch plaintext become ciphertext before network transmission.
The server receives only an opaque ciphertext blob. Server operators, hosting providers, or hackers have zero ability to decrypt your credentials.
A rogue actor with your login handle cannot automatically sync your passwords on a new machine. The new device must be authorized by your original installation.
When you install OmniVault on a new phone or laptop, it registers an ephemeral device ID and displays a unique 6-digit pairing code.
Your primary desktop receives an interactive notification showing the incoming device name, platform, and matching pairing code.
Once you click "Authorize", the central node issues an active device session token. Both devices now sync encrypted blobs seamlessly.
A modern password manager engineered with defense-in-depth principles.
Double PBKDF2 hashing prevents server database compromise from ever leaking your master password or authentication hash.
Real-time client-side password strength auditing detecting weak, reused, and compromised passwords before breaches occur.
Built-in RFC 6238 TOTP engine generating 6-digit rolling codes with automated clipboard copying and countdown timers.
Segment personal, work, financial, and shared credentials into isolated containers with customizable categories.
System-wide hotkey (⌘+Shift+V or Ctrl+Shift+V) to search and instant-copy credentials without breaking your workflow.
Access and search all your credentials offline. Encrypted revisions merge automatically once your connection resumes.
Auditable, industry-standard mathematical primitives.
| Domain | Primitive / Standard | Parameter / Detail |
|---|---|---|
| Symmetric Encryption | AES-GCM (Galois/Counter Mode) | 256-bit key, 96-bit unique IV, 128-bit authentication tag |
| Key Derivation (Client) | PBKDF2-HMAC-SHA256 | 100,000 iterations with 32-byte cryptographic salt |
| Server Verifier Hash | PBKDF2-HMAC-SHA256 (Double Hash) | Additional 100,000 iterations server-side with unique salt |
| Two-Factor Auth | TOTP (RFC 6238) + SHA-256 Recovery | Google Authenticator / Authy compatibility + single-use emergency keys |
| Licensing & Hosting | MIT Open Source License | 100% open source & self-hostable (Free). Managed Cloud Sync is optional paid. |
| Account Profile & Sync Flags | Profile Entitlement Engine | All account details & entitlement flags sit on user profile. Cloud sync activates when paid license turns flag ON. |
Native desktop builds for macOS, Windows, and Linux, plus a progressive web vault.
OmniVault is 100% MIT Open Source. Use it locally or self-host your own sync server for free forever. Subscribe to Pro or Business if you want us to host and maintain your managed cloud sync infrastructure.