Master Password + Secret Key
A randomly generated, high-entropy Secret Key is intended to strengthen protection beyond a human-chosen master password. It does not make attacks impossible.
SECURITY APPROACH
Designed so the server does less.
The intended security model starts on your device: encrypt vault data before synchronization and keep vault decryption secrets away from the server.
THE TRUST BOUNDARY
Encrypt before sync.
127Vaults is designed for vault data to be encrypted on a client device before it is synchronized. The server should coordinate encrypted changes and device registration without holding plaintext passwords.
The server coordinates encrypted synchronization and device registration. Vault decryption secrets stay with authorized clients.
LAYERS OF PROTECTION01 02 03
More than a master password.
Device identity
Every authorized device has its own cryptographic identity and key material. The server should hold public device information, not private device keys.
Offline copies
Authorized clients are designed to retain encrypted local vault copies, so a server interruption should not block data already synchronized to a device.
PRIVATE BY DESIGN
Access follows the user.
Private vaults belong to their users. Administration does not automatically grant a cryptographic path into every private vault; recovery is explicit.
All plans use the same core security approach. The choice of self-hosting or Cloud changes who operates the server, not the strength of vault encryption.
Explore the productONE ARCHITECTURE
Compare plansNo premium encryption tier.
All plans are intended to share the same fundamental security model.