AES-256-GCM
Encrypts your data and detects any tampering. A fresh random nonce for every encryption means the same item can look different each time it is encrypted.
Details in the whitepaper →The Inlockly security model
Your data. Your keys.
Your control.
Everything you save in your vault is encrypted on your device. Only encrypted content reaches the cloud, and we don't have the key to read it.
Zero-knowledge. Privacy built into the architecture.
On your device
AES-256-GCMEncrypted before upload
a8f2 09cb e741 5d3a 8c01 2f6e
7b4d c803 6a29 f1e5 0d92 8b3c
2e91 b6a4 03fd 8c27 5a10 d9efInlockly cloud · contents unreadableSimplified diagram · sample data
Security built in from the ground up.
AES-256-GCMData encryption
RSAPublic-key cryptography
Argon2idKey from your master password
Zero-knowledgeYour data stays yours
01 / Private from the very first step
Before your data leaves your device,
it is already encrypted.
Zero-knowledge means we cannot read what is in your vault. Protection starts with you, before anything is synced.
On your device
You know your password. We never receive it.
Argon2id derives a key from your master password, and that key protects access to your vault key. The master password itself is never sent to the server.
Simplified diagram. Full details in the security whitepaper →Local encryption
Readable to you. Encrypted before it leaves.
Your data is encrypted with a random vault key using AES-256-GCM. The vault key is protected separately, so your master password isn't used directly to encrypt every item.
Simplified diagram. Full details in the security whitepaper →Sync across devices
The cloud syncs. Your device decrypts.
The server stores encrypted content. Reading it on another authorized device requires the right keys. On top of that, the connection to the server is protected by TLS.
Simplified diagram. Full details in the security whitepaper →02 / Proven mechanisms. Clear jobs.
Every layer has a job to do.
From key derivation to protecting shared data. Here is what is behind the names of the technology.
Argon2id
Derives a key from your master password. Its memory and compute cost makes large-scale password guessing much harder.
64 MiB memory · 4 iterations · 4 threadsDetails in the whitepaper →RSA-OAEP
Protects how a group vault key is handed to group members. The data itself is still encrypted with AES - each mechanism does its own job.
RSA 2048-bit · OAEP · SHA-256Details in the whitepaper →Protected in transit, too. Your connection to the server is secured with TLS. That is an extra layer on top of encrypting your vault contents on your device.
03 / Security in everyday use
Good security
works alongside you.
Cryptography is the foundation. App features help you stay safe in how you use your data every day.
Your master password stays with you.
It never reaches the server. It guards the keys you need to unlock your vault.
A second step at sign-in.
Two-factor authentication helps keep your account safe even if someone learns your login details.
Know which passwords need attention.
SafetyMeter™ helps you spot weak and reused passwords and act on data breach alerts.
Step away? Your vault locks.
Auto-lock after a period of inactivity limits access to your data on a device left unattended.
Sensitive data doesn't linger in your clipboard.
Automatic clipboard clearing limits how long copied data stays available.
The right login on the right site.
Autofill matches your saved logins to the website. It's still worth checking the address before you sign in.
Feature availability depends on your plan. Compare plan features →
Good to know
Security.
No fine print.
Have a question about how we protect you?
Can Inlockly read my passwords?
We don't have the keys needed to read what's in your vault. Encryption and decryption happen on your device. When you share data, only authorized group members get access.
Does zero-knowledge mean you store no data at all?
No. Zero-knowledge applies to the contents of your encrypted vault. Running your account also requires some service data, such as your email address. Our Privacy Policy explains what we process.
How is 2FA different from vault encryption?
Two-factor authentication adds protection to signing in to your account. Encryption protects the contents of your items. The two work together, but they do different jobs.
Why does a strong master password matter so much?
Your master password is used to derive the key that protects access to your vault. Choose a long, unique password you don't use anywhere else. Never share it with anyone - including Inlockly staff.
Where can I find the technical parameters and diagrams?
In our Security Whitepaper - online and as a PDF. It covers the cryptographic parameters plus diagrams for account creation, sign-in, changing your password, unlocking your vault, and recovering access.