← catkeys

Privacy

catkeys is a password manager where the server cannot read your passwords. This page explains exactly what that means, including the parts where it is less absolute than it sounds.

What the server stores

• Encrypted blobs, one per vault entry. The server has no key that opens any of them.
• Public keys for your account and each of your devices.
• An HMAC of your email address — never the address itself. See below.
• Wrapped copies of your account key, which only your password or your Emergency Kit unwrap.
• Timestamps, a version counter per entry, and a redacted audit log of security events.

What the server never stores

• Your master password, in any form — not hashed, not encrypted, not in a log.
• Any key that can decrypt your vault.
• Your email address in readable form.
• The contents, titles, usernames, URLs, or notes of anything in your vault.

How the encryption works

Your password and a Secret Key generated on your device are combined to derive a key that never leaves your browser. That key unwraps your account key, which decrypts each entry with its own separate key. Encryption and decryption happen on your device, before anything is sent and after anything is received.

The algorithms are post-quantum throughout: ML-KEM-1024 and ML-DSA-87, the NIST-standardised schemes, with AES-256-GCM for content and Argon2id for turning your password into a key. There is no classical public-key cryptography anywhere in the system, so a future quantum computer does not retroactively open data captured today.

Your email address

catkeys never stores your address. It stores a keyed hash of it, and every operation — signing in, recovery, verification — works from that hash. A copy of the database does not reveal who has an account, and we cannot produce a list of our users' email addresses, because we do not have one.

Your address does pass through our mail provider when we send you a verification code. That is the one moment it exists in readable form outside your device.

What we cannot do

We cannot recover your vault. Not for a court order, not for you. If you lose both your password and your Emergency Kit, the data is gone — we hold only ciphertext and no key. (The one exception is a folder name you have explicitly chosen to publish; see below.) That is the design working as intended, and it is the reason the Kit ceremony during signup has no skip button.

What the server can still see — and we won't pretend otherwise

Encryption protects contents, not the existence of things. The server can see how many entries you have, roughly how large each one is, when you created or last changed each one, when you sign in, and from which devices. It does not know what any of them are.

Folder names are encrypted along with everything else, so the structure of your vault is not visible either — unless you choose to publish one. That is the single exception on this page, and it is described in full below.

The one thing you can choose to make readable

If you connect catkeys to an AI assistant, you can publish the name of a folder — one folder at a time, off by default, and never automatically. A published name is stored in plain text on the server. Nothing else about that folder is: not what is in it, not how many entries it holds, not where it sits in your folder structure, not who or what it belongs to.

It exists so an assistant with nothing loaded can tell you “I don’t have your work passwords available” instead of “I have no idea what exists”. We think that is worth a folder name to some people and worth nothing to others, which is why it is opt-in per folder and why you can unpublish a name at any time — unpublishing deletes the stored name rather than blanking it.

If you never publish a name, the server holds no plain text from your vault at all, and the paragraph above about folder structure applies without exception.

The browser client is a different trust model

This is the most important limit on this page. The vault at catkeys.app/app/ is code that our server sends to your browser every time you load it. Your data is encrypted on your device and we store only ciphertext — but a compromised server could serve modified code that captures your password as you type it. No amount of client-side cryptography changes that, because the client itself arrives from us.

This is true of every browser-based password manager, and it is permanent rather than something we intend to fix later. We say it here, and on the unlock screen itself, so it is a decision you make rather than an assumption you inherit.

How long things are kept

Vault entries are kept until you delete them. When you change an entry, the previous encrypted version is retained for a short window so that a mistake — or someone with a stolen session — cannot destroy your data irreversibly. Verification codes expire in minutes. Sign-in challenges expire in minutes. Audit records carry a keyed hash of the requesting address, never the address itself.

Deleting your account, and getting your data out

You can export your vault at any time, from the account menu. The export is produced by your browser after decrypting locally, so it is a readable file — treat it accordingly.

Deleting your account removes your entries, their history, your devices and your sessions, and frees your email address so it can be registered again. There is no soft-delete and no recovery window; the ciphertext is gone and we could not have read it anyway.

One thing does survive, and we would rather say so than let you discover it. Security audit records — the keyed hash of an address, the name of an event such as a failed sign-in, and a keyed hash of the requesting network address — are kept for abuse investigation, including a record that the deletion happened. They contain no contents, no keys, and no readable address. Because deletion frees your email address for reuse, an audit record written before the deletion shares a hash with any account later registered at that same address.

Third parties

There are no analytics, no trackers, no advertising, and no third-party scripts on any catkeys page — the vault loads nothing from any origin but this one. Our mail provider sees your address when a verification code is sent. Our CDN sees your IP address and which pages you request, as it would for any website.

catkeys · Changelog