Understanding Your Security

Your Secret Key is a unique 34-character code that is automatically generated when you create your account. It works together with your Master Password to encrypt and protect your data. Because your Secret Key is long and randomly generated, it adds a powerful layer of security that guards your account even in the unlikely event of a server breach.

You should store your Secret Key somewhere safe, such as in a printed copy kept in a secure location. We do not have access to your Secret Key, which means only you can unlock your data.

Your Master Password is the password you create and use every time you sign in. It should be strong, memorable, and known only to you. A good Master Password is typically long, uses a mix of unrelated words or characters, and avoids anything easily guessed like birthdays or common phrases.

Unlike your Secret Key, which protects your account at the server level, your Master Password is what protects your data on your own devices. We never store or transmit your Master Password, so it is essential that you remember it. If you lose it, we cannot recover it for you.

Every piece of data you store in GBpass (your passwords, usernames, notes, and other vault items) is encrypted using AES-256-GCM. That is the Advanced Encryption Standard with a 256-bit key, in Galois/Counter Mode, which both encrypts your data and detects any tampering with it. AES-256 is a public standard published by NIST (FIPS 197), open for anyone to review. No practical attack against it is publicly known.

The encryption key used to protect your vault is derived from your Master Password and Secret Key using Argon2 and PBKDF2, key derivation functions that make every guess computationally expensive. Argon2 additionally requires a significant amount of memory per attempt, which blunts GPU-based cracking. This means that even if someone obtained your encrypted vault data, they could not read it without knowing both your Master Password and Secret Key. Deriving the key from guesses alone would take an impractically long time, even with powerful hardware.

Encryption happens entirely on your device before any data is sent to our servers. Our servers only ever receive and store your vault in its encrypted form. We have no way to decrypt your data, and neither does anyone else, not even GBpass employees. Your plaintext passwords exist only on your own devices, never on ours.

Your vault isn't protected by one key. It's protected by a chain of them, each layer unlocking only the next. This layered "envelope" design means every item is sealed with its own key, so no single stored secret can open your data. The chain starts from two things only you have, and every key in it lives exclusively on your devices.

There is no lesser version of this. Every GBpass account, free or paid, uses exactly the hierarchy above. We removed the old guest mode, which protected on-device data with a single local key, so that nobody is left on a weaker model.

When you sign in, we use a security protocol called SRP (Secure Remote Password) to verify your identity. SRP is a special authentication method that allows you to prove you know your Master Password without ever actually sending it to our servers. Instead of transmitting your password over the internet, SRP uses a series of mathematical exchanges between your device and our server so that both sides can confirm you are who you say you are, all without exposing your actual credentials during the process.

This means that even if someone were to intercept the communication between your device and our server, they would not be able to extract your Master Password from the data being exchanged. Unlike traditional login systems where your password is sent to the server and checked against a stored copy, SRP ensures that your password never leaves your device in any form. Our server never receives, stores, or even briefly handles your Master Password at any point during the login process.

By using SRP, we eliminate many of the most common risks associated with online authentication, such as password theft through server breaches or man-in-the-middle attacks. Your credentials stay on your device where they belong, and the entire sign-in process remains secure from start to finish.

We use a security approach called Zero-Knowledge Encryption, which means that we have no way to see, access, or read your stored data. Your information is encrypted on your device before it is sent to our servers, and only you hold the keys needed to decrypt it: your Master Password and Secret Key. We never receive or store these keys, so even our own team cannot view your data at any point. In simple terms, we protect your information without ever knowing what that information is.

This design matters most in the worst-case scenario. If our servers were ever breached, what an attacker would obtain is your vault in its encrypted form: ciphertext that cannot be decrypted without your Master Password and Secret Key, and those never leave your hands. It also means there is no readable copy of your data for us to hand over or expose, even if we were compelled to.

Zero-Knowledge Encryption is one of the strongest data-privacy designs available today. It means you do not have to place blind trust in us to keep your data safe. The system is designed so that trust is not required. The math and encryption do the work for you. Your privacy is not just a policy we follow; it is built into the very architecture of how your data is stored and protected.

Zero-knowledge is a big claim, so here it is in plain terms: the complete list of what GBpass can and cannot see about what you store.