How the Vault keeps things safeNew

What's protected

Every item is encrypted in your browser with its own key before it leaves your device, and your Vault's key is locked with the keys of your encrypted chats, which only your devices hold. Names, websites, usernames, passwords, codes, notes, folders and even the kind of each item are all inside that encryption.

What our servers can see

• That you have a Vault, and how many items are in it.
• The rough size of each item (sizes are rounded up in steps of 256 bytes) and when it was last changed.
• A number that goes up with each change to an item, and one for the Vault as a whole.

We can't see what any item is or says.

The breach check

When you choose Check passwords in Health, or check one password on a login, your browser works out a SHA-1 hash of each password and sends only the first 5 characters of that hash to Viremail. We pass those 5 characters to Have I Been Pwned, which returns every known leaked password hash that starts the same way (hundreds of them, plus padding so each answer is about the same size). Your browser then looks for the rest of the hash in that list. Neither we nor Have I Been Pwned learn your password or its full hash. We keep the answers in memory for a day, because they're the same for everyone, and we never log the 5 characters. Nothing is checked until you ask.

How changes are checked

Your devices keep a list of every item and its latest version, sealed with your Vault's key, and each change adds to a chain of these lists. Each device checks what Viremail sends against that list. If an item is missing, older than it should be, or not on the list, or if Viremail shows an older or different version of your Vault than this device saw before, the Vault shows a warning and won't save changes until it's sorted out. Your items are still shown so you can look, but check anything important on another device. If you see one of these warnings, contact us.

Every change also has to carry a key made from your Vault's key, which only an unlocked Vault has. Someone who got hold of your signed-in session alone can't change or delete what's in your Vault.

If a browser that opened your Vault before finds none, the locked screen says so. Resetting encryption erases the Vault, so that's expected after a reset. If you didn't reset, don't make a new Vault yet: contact us first.

When it locks

The Vault's key is only in the memory of an open tab, and only while the Vault is unlocked. It locks, and forgets everything it opened, when:

• you choose Lock (or press L), in this tab and in your other tabs of this browser;
• there has been no activity for the time you chose (15 minutes unless you changed it);
• encryption is locked on this browser, you sign out, or your security key needs attention;
• the desktop app wakes up after sleep.

Nothing from inside your Vault is saved on your device, not even in the browser's storage.

Honest limits

• The lock protects an open app. On a computer or phone that's switched off, your encryption keys rely on the device's disk encryption (in a browser) or the computer's key store (in the desktop app). Keep disk encryption and a screen lock on.
• The app itself comes from viremail.com. Like any encryption that runs in a web page, if someone took over viremail.com, they could change the app so it reads an unlocked Vault. The desktop app loads the same pages from viremail.com, so the same is true there.
• Clearing the clipboard has limits. A browser can only clear what it copied while its tab is in front, and it can't tell whether you copied something else in another app since. So a copied password is cleared only if this tab is in front and nothing else was copied here since. Clipboard history tools on your computer may keep their own copy.
• Your Vault shares your encryption keys. If you lose your recovery key and every device, and reset encryption, your Vault is erased with it: there is no way back in. A reset asks you to tick a box first and says how many items would go. Replacing your keys or your recovery key keeps your Vault, but it must be unlocked in that tab first (or you can choose to erase it).
• Anyone who can use your unlocked device can use your open Vault. Lock it when you step away, and choose a short auto-lock on shared computers.
• An export is only as safe as where you keep it. An encrypted export is as strong as its passphrase and the device it's on. A plain CSV export isn't protected at all. See Import into and export from your Vault.