PassMate

Security

How PassMate protects your data — in plain language.

Zero knowledge, end to end

Everything you store in PassMate is encrypted on your device before it is saved or synced. The server only ever receives ciphertext — an unreadable blob. It never sees your items, their names, your passwords, or your master password. There is no admin view, no support tool, and no database query that could reveal them: the keys simply never leave your devices.

The keys

  • Master password — known only to you, never transmitted. A hardened key-derivation function (Argon2id) turns it into an encryption key on your device.
  • Vault key — a random 256-bit key that actually encrypts your items (AES-256-GCM). It is stored only in wrapped (encrypted) form.
  • Recovery key — generated once at setup and shown to you a single time. It is the only way back in if you forget your master password.

The honest caveat

If you lose both your master password and your recovery key, your data is gone — permanently, for everyone, including us. This is not a limitation we forgot to fix; it is the direct consequence of a design with no backdoors. We would rather tell you this plainly than pretend otherwise.

On your device

  • The vault locks automatically after inactivity or when the app goes to the background.
  • Copied secrets are cleared from the clipboard after 30 seconds.
  • Biometric unlock, where enabled, is bound to your device's secure hardware; re-enrolling biometrics invalidates the stored key.
  • App content is hidden from screenshots and the app switcher on mobile platforms.

Breach checking without exposure

The password health report can check your passwords against the Have I Been Pwned database using k-anonymity: only the first five characters of a one-way hash are ever sent. Your passwords — and even their full hashes — never leave your device.

What the server does see

To run the service at all, the backend (Google Firebase) stores your account email address, authentication metadata, and the encrypted ciphertext of your vault. That is the complete list. Details are in the Privacy Policy.

Questions

Security questions or reports are welcome at support@passmate.tech.