How it works
Your master password never leaves your device
When you log in, your device transforms your master password with Argon2id and derives two different keys: an access proof, the only thing sent, and a key that unlocks your account key and never travels. The server stores only a hash of the access proof.
Each item is encrypted before being sent
Every password, card or note is encrypted with its own key (XChaCha20-Poly1305) and that key is stored encrypted with your account key. The site name, username and folders are also encrypted. The server sees that an encrypted piece of data exists, not what it contains.
If you lose your master password
No one, including our team, can open your vault for you. When you create your account you get 8 single-use recovery codes: each lets you choose a new password without losing your data. If you lose your password and your codes, the only option is to reset the account by email, which deletes your whole vault.
Account protection
If someone logs in from a new country or device, we ask you to confirm it by email before opening the session. You can view your devices, close them, change your password and rotate your key if you think it leaked.
What we can't promise
WolfPass hasn't undergone an external audit yet. If your device has malware, it can read your vault while it's unlocked: encryption protects what's stored, not a compromised device. That's why the session closes after 15 minutes without activity.