Security

How Stashkey protects your data

Stashkey is designed on one rule: your data is encrypted and decrypted only on your devices. Our servers store data they cannot read.

Security model

Your master password

• Your master password never leaves your device and is never stored, on the device or on our servers.
• Your device stretches it with Argon2id, a memory-hard key derivation function that makes guessing attacks slow and expensive.
• The resulting key unlocks your vault locally. Face ID or fingerprint unlock uses your device's secure hardware to protect a key, not your password.

Your vault

• The vault is stored in the open KDBX4 format, encrypted with AES-256 or ChaCha20.
• When sync is used, only the encrypted vault is uploaded. The server stores encrypted blobs and some account metadata.
• If our servers or database were stolen, the attacker would get encrypted blobs and no keys to open them.

No password reset, by design

Because we never have your master password, we cannot reset it. When you create an account, Stashkey shows a recovery key once. Print it or write it down and keep it safe. Without the master password or the recovery key, a vault cannot be opened by anyone, including us.

Sharing

• Each shared folder has its own key. That key is encrypted (“wrapped”) separately for each member using X25519 public-key cryptography, so the server only holds wrapped keys it cannot use.
• When a member is removed, the folder key is rotated. Data written after removal uses a new key the removed member never receives.

Breach checks

The security check finds weak, reused and breached passwords. Weak and reused checks run entirely on your device. Breach checks use Have I Been Pwned with k-anonymity: only the first 5 characters of a password's SHA-1 hash are sent, and the match is done on your device.

Cryptography

We use only well-studied, standard algorithms and do not invent our own: Argon2id for key derivation, AES-256 and ChaCha20 for encryption, and X25519 for key exchange.

Open-source core

The cryptographic core is open source so anyone can check how it works. Repository: github.com/Stash-Key/core Will be public at launch

Reporting a vulnerability

If you believe you have found a security problem in Stashkey, please tell us privately first so we can fix it before it is used against people.

• Email [email protected] with a description, steps to reproduce and the impact you expect.
• We aim to acknowledge reports within 3 working days and to keep you updated until the issue is resolved.
• Please give us reasonable time to fix the issue before sharing it publicly. We are happy to agree on a disclosure date with you.
• We will credit you when the fix ships, if you would like that.

Please do

• Test only against your own accounts and data.
• Stop and contact us if you reach data that is not yours.

Please do not

• Access, change or delete other people's data.
• Run denial-of-service attacks, spam or social engineering against users or staff.
• Test physical security or third-party services we use.

We will not take legal action against people who report issues in good faith and follow these guidelines.

Machine-readable contact details: /.well-known/security.txt