Two keys to open your vault
Your passphrase, plus an Account Key that never leaves your device. Breaking into our servers and guessing your passphrase still isn't enough.
Learn more about the two keys →Security
Your agent never holds the secret.
We can't read your vault.
Nobody else in the field does both.
Encryption
Zero knowledge: we can't read your vault.
Everything is encrypted in your browser with AES-256, using keys that never reach us. We store only the encrypted copy, and nothing that opens it.
How a secret is locked.
-
You add a secret in your browser.
-
Your browser encrypts it before it leaves.
-
We store it encrypted. We can't open it.
-
Only your broker opens it, on your computer.
Slow to guess, on purpose
Your passphrase is stretched with Argon2id, which makes every guess expensive for an attacker.
Learn more about Argon2id →A quantum-resistant connection
Your browser and our servers already agree keys with a hybrid post-quantum method.
Learn more about the connection →Secret protections
How your agent is kept from the secret.
Your agent never gets the secret itself. A broker on your computer makes the call and hands back only the answer.
How a secret is used.
-
Your agent asks for a call. It names the service, not the secret.
-
Your broker adds your secret, on your computer.
-
The broker sends it over HTTPS. The service answers.
-
Your agent gets the answer, with your secret taken out.
-
Web services
The broker attaches your secret, or signs with it, and sends the request.
-
SSH
The broker signs the login, only for the hosts you listed.
-
Wallets
Pays in USDC on Base or Solana, within your daily limit, to payees you trust. Anything else waits for you.
-
Signing keys
Signs only what you approve, one signature at a time.
Web calls use HTTPS only, with real certificate checks. Your secret is never sent on through a redirect, and private network addresses are refused unless you allow one. Learn more about brokered calls →
What guards your secrets.
A broker your agents can't open
It runs under its own account on your computer, so an agent can't read its files or its memory.
Learn more about the broker →Approvals for the secrets that matter
An "ask me first" secret waits for your approval before it goes anywhere new.
Learn more about approvals →Only your broker can ask for a secret
Our server hands a brokered secret only to a request signed by the broker you paired. A copied agent password isn't enough.
Learn more about signed requests →A record you can check
Every use is written to a tamper-evident log, and your computer keeps a full log of its own, signed line by line. We keep a fingerprint of each line, so a changed log shows.
Learn more about the record →Repairing an agent changes the lock
A repaired agent gets a brand-new vault key, and we show you which secrets to replace at their providers.
Learn more about repair →Emails that never say where
When a secret needs you, we email which agent and which secret, by the names you gave them. Never where it was going, or why.
Learn more about approvals and alerts →Privacy
What we can see, and what we can't.
We can't see
- Your secrets
- Your passphrase or Account Key
- Where a "run without asking" secret was sent, or why
- What kind of secret a value is. Your browser works that out on your computer, and only when you ask.
We can see
- Your email address
- The names you give your secrets and agents
- How each secret is attached to a request, for example a header named x-api-key, which can hint at the service
- Which agent used which secret, when, what happened, and from what IP address
- For an "ask me first" secret, where it's going and why. We erase the reason when you decide, and the destination once the approval is used up.
- A fingerprint of each line of your computer's log, which reveals nothing about it
Kept on your computer
- A full log of every use: where each secret went, your agent's reason, and what happened
- Signed line by line and kept for a year
Read them with sudo /usr/bin/node /usr/bin/wundervault-agent --destinations on Linux, or sudo /usr/local/bin/node /usr/local/bin/wundervault-agent --destinations on a Mac: node and the broker by full path, as the installer prints them (the paths can differ: use the ones it printed). With sudo, a bare name could be found in a folder your agents can write. On Windows, run wundervault-agent --destinations in an Administrator PowerShell.
Routine log entries are deleted after 30 days, or the time you choose, up to a year. Security events are kept for a year, and so is your computer's log. Backups are deleted after 60 days. Read our privacy policy →
What if
If something goes wrong.
Someone steals our database
They find your vault, locked. Every passphrase guess is slow, and even a right guess needs your Account Key, which was never on our servers.
Learn more about a stolen database →Your agent is tricked
A web page tells it to send your Stripe key, but it has none to send. On "ask me first", a call to anywhere new waits for you. On "run without asking", the call goes where your agent says, so put secrets that matter on "ask me first".
Learn more about a tricked agent →You lose your laptop
Sign in from any browser and revoke its agents, and our server refuses them from then on. If someone may have the laptop, replace the secrets those agents could use.
Getting back into your vault on a new device →Your account
How your account is protected.
-
Sign in with a passkey
Your face, fingerprint or the screen lock on your phone or computer signs you in. Where your device supports it, the same touch opens your vault. Once you add a passkey, your account has no password to steal.
-
Your phone's passcode counts
A passkey accepts your phone's passcode when Face ID fails, so someone with your phone and its passcode could get in. Turn on Stolen Device Protection on an iPhone, or Identity Check on Android: away from home, your face or fingerprint is then required.
-
A fresh check for what matters
Approving a request, or switching a secret to "run without asking", needs your passkey from the last hour. Changing your email, removing a passkey or deleting your account asks for it each time. Being signed in isn't enough.
-
Lost every passkey?
A recovery code gets you back in after 3 days. We email you the moment it starts, and you can cancel from that email or from any device you're signed in on, so a stolen code alone can't take your account.
-
Alerts when things change
Unless you turn them off, we email you when someone signs in or adds a passkey. Removing a passkey, a recovery and an email change always email you.
-
A new email is confirmed first
Changing your email takes your passkey, then a code sent to the new address before we switch. We tell the old one.
-
Only you can open your vault
We can't open it for you. On a new device, your passkey opens it if your Apple or Google account has carried the passkey across. Otherwise enter your passphrase and Account Key, or use a recovery code.