Zero-Knowledge Encryption

Overview

Heimlane Vault uses zero-knowledge encryption, meaning your data is encrypted on your device before it ever reaches our servers. We cannot read your passwords, and neither can anyone else - unless you share your master password, which you should never do (see the Master Password article).

What Zero-Knowledge Means

Zero-knowledge means Heimlane has zero knowledge of your:

• Master password
• Encryption keys
• Vault contents (passwords, notes, files)

How It Works

Encryption Process

1. You enter your master password
2. Key derivation: Your password is transformed into encryption keys using Argon2id (memory-hard - 64 MiB of memory, 3 iterations, 4 threads).
3. Local encryption: Your vault data is encrypted with AES-256 on your device
4. Secure transmission: Only encrypted vault data leaves your device - your master password is never sent
5. Encrypted storage: Data remains encrypted at rest on our servers

Decryption Process

1. You log in with your master password
2. Encrypted data is downloaded to your device
3. Local decryption: Your device uses your keys to decrypt
4. Plain text only exists in your device’s memory

Technical Details

Benefits of Zero-Knowledge

Your data can’t be used without your master password - and that password never leaves your device.

The Trade-off

Zero-knowledge means we cannot help you if you forget your master password:

• There’s no “forgot password” reset
• We cannot decrypt your data for you
• Recovery is only possible with your master password hint or recovery options you’ve set up

On a Premium plan you can set up Emergency Access: a trusted contact you designate can request access to your vault after a waiting period. It gives you a recovery path if you ever lose access yourself, without weakening zero-knowledge encryption.

This is a feature, not a bug. It’s the only way to guarantee your privacy.

Tips

• Use a strong, unique master password you can remember
• Set up a password hint that only you understand
• Configure emergency access (a Premium feature) for account recovery scenarios
• Keep local backups of critical information