Per-item keys wrapped in AWS KMS, requests signed by the device that sends them, number matching on your phone, and a record of every reveal written before the value is shown.
Why it matters
Opening one item never opens another, because each has its own key, bound to that item.
Requests are signed by a key that lives with the device, so a stolen cookie or a copied app cannot pretend to be it.
Number matching means the person at the screen and the person holding the phone have to agree.
How it works
What happens between pressing Show and seeing one field.
The exact mechanisms
Every item gets a fresh data key from AWS KMS, wrapped under the vault's own dedicated KMS key with an encryption context naming the owner, the vault and the item. A sealed payload copied to another item will not open. Every unwrap is logged in AWS CloudTrail.
The Chrome extension and the desktop app sign each request with their own P-256 key. The vault refuses a request more than 120 seconds old or one it has already seen. On a Mac the key lives in the Secure Enclave; in Chrome it is a key the extension cannot export.
Your phone shows three numbers and your screen shows one. A wrong number refuses the request. “It wasn't me” refuses it and records it. Vaarta Authenticator asks for your biometric on every approval.
Unlocking on a computer or in Chrome opens a session of five minutes at most. A reveal returns one field per request. In the web console a reveal needs a step-up no older than five minutes. Every reveal is recorded before the value is returned.
A card asks your phone every time, shows for 60 seconds, and each field can be used once per approval. Cards and identities live only in your personal vault: never shared with an organization, never seen by an agent.
Only the current six-digit code ever leaves the vault. The authenticator key that makes it never does.
Mark an item device-only in the Mac app and it is sealed on that computer with AES-256-GCM, its key in the macOS Keychain. No request to our servers ever carries it.
The Mac app locks on sleep, screen lock, idle, closing the window or quitting. The extension locks on screen lock, idle or closing its popup. Anything you copy is cleared from the clipboard after 30 seconds.
Only the first five characters of the password's SHA-1 hash leave, to a k-anonymity range query, with padding so the reply size says nothing. The prefix comes from a stored hash, so no item is opened to check it.
Export your personal vault after a fresh step-up, as one file sealed with a passphrase of at least 12 characters. One-time-code keys and cards come along only if you choose them and confirm.
Up to ten files on any item, 1 MB each, each under its own data key. A download needs a step-up and is recorded.
Reused passwords, weak ones found on a known-bad list, and breached ones, in one list with a health ring.
Your choices
Choose 1, 2 or 5 minutes for the Mac app and the extension. Five is the default.
Keep any item on one Mac, out of sync, out of our servers.
Set a signing key to ask before every signature (the default), or allow a time-limited grant.
Optionally require Touch ID to open the Mac app's window.
Every browser, computer and agent is listed in your vault. Disconnect one, or all.
Export everything in your personal vault, sealed with your own passphrase, whenever you like.
Security notes
In which planAll of this, in every plan.See plans →
See plansCreate your vault, link your phone, and bring everything in from where it lives today.
