Security
Understanding your security.
The GBpass password manager guards your vault with two secrets, and neither one is ever sent to us. Here is exactly how that works.
Part 1
Secret Key
Your Secret Key is a unique 34-character code that is automatically generated when you create your account. It works together with your Master Password to encrypt and protect your data. Because your Secret Key is long and randomly generated, it adds a powerful layer of security that guards your account even in the unlikely event of a server breach.
You should store your Secret Key somewhere safe, such as in a printed copy kept in a secure location. We do not have access to your Secret Key, which means only you can unlock your data.
Keep it safe. Store a printed copy of your Secret Key in a secure physical location: a safe, lockbox, or secure drawer. If you lose both your Secret Key and your recovery options, we cannot restore access to your account.
Part 2
Master Password
Your Master Password is the password you create and use every time you sign in. It should be strong, memorable, and known only to you. A good Master Password is typically long, uses a mix of unrelated words or characters, and avoids anything easily guessed like birthdays or common phrases.
Unlike your Secret Key, which protects your account at the server level, your Master Password is what protects your data on your own devices. We never store or transmit your Master Password, which is why you have to remember it. If you lose it, we cannot recover it for you, and nobody else can either.
Tips for a strong Master Password
Two secrets, both required
Together, your Secret Key and Master Password form a two-part security model. Both are required to open your account on a new device. No single piece of information is enough on its own.
Keep them both safe, keep them separate, and never share them with anyone, not even with GBpass support.
How your data is encrypted
How your data is encrypted
Every piece of data you store in GBpass (your passwords, usernames, notes, and other vault items) is encrypted using AES-256-GCM. That is the Advanced Encryption Standard with a 256-bit key, in Galois/Counter Mode, which both encrypts your data and detects any tampering with it. AES-256 is a public standard published by NIST (FIPS 197), open for anyone to review. No practical attack against it is publicly known.
The encryption key used to protect your vault is derived from your Master Password and Secret Key using Argon2 and PBKDF2, key derivation functions that make every guess computationally expensive. Argon2 additionally requires a significant amount of memory per attempt, which blunts GPU-based cracking. Someone holding a copy of your encrypted vault still has nothing to read. They would need both your Master Password and your Secret Key, and guessing their way to the key would take an impractical amount of time even on powerful hardware.
Encryption happens entirely on your device before any data is sent to our servers. Our servers only ever receive and store your vault in its encrypted form. We have no way to decrypt your data, and neither does anyone else, not even GBpass employees. Your plaintext passwords exist only on your own devices, never on ours.
How your keys fit together
The chain of keys
Your vault isn't protected by one key. It's protected by a chain of them, each layer unlocking only the next. This layered “envelope” design means every item is sealed with its own key, so no single stored secret can open your data. The chain starts from two things only you have, and every key in it lives exclusively on your devices.
There is no lesser version of this. Every GBpass account, free or paid, uses exactly the hierarchy shown here. We removed the old guest mode, which protected on-device data with a single local key, so that nobody is left on a weaker model.
How sign-in works
Signing in without sending your password
When you sign in, we use a security protocol called SRP (Secure Remote Password) to verify your identity. SRP is a special authentication method that allows you to prove you know your Master Password without ever actually sending it to our servers. Instead of transmitting your password over the internet, SRP uses a series of mathematical exchanges between your device and our server so that both sides can confirm you are who you say you are, all without exposing your actual credentials during the process.
Anyone intercepting that exchange gets nothing they can turn back into your Master Password. A traditional login sends the password to the server, which compares it against a stored copy; SRP never sends it at all. Our server does not receive it, store it, or handle it even briefly.
That removes two of the usual ways passwords are stolen: lifting them from a breached server, and reading them off the wire in transit. Neither one has anything to take.
Privacy by design
Why we cannot read any of it
Zero-knowledge encryption means we hold your data without ever being able to open it. Your information is encrypted on your device before it is sent to us, and the keys that decrypt it, your Master Password and Secret Key, are never sent to us or stored by us. That applies to our own engineers as much as to anyone outside the company.
This design matters most in the worst-case scenario. If our servers were ever breached, what an attacker would obtain is your vault in its encrypted form: ciphertext that cannot be decrypted without your Master Password and Secret Key, and those never leave your hands. It also means there is no readable copy of your data for us to hand over or expose, even if we were compelled to.
You do not have to take our word for any of this. Without your Master Password and Secret Key there is nothing readable on our side to protect, and that stays true whether or not our policies ever change. Trusting GBpass is not part of the design.
Zero-knowledge in practice
What we can and can't see
Zero-knowledge is a big claim, so here it is in plain terms: the complete list of what GBpass can and cannot see about what you store.
What we can never see
What we can see
That's the whole list. Everything else reaches our servers already encrypted.