How GBpass protects you

A quick tour of the Secret Key, Master Password, AES-256 encryption, SRP sign-in, and zero-knowledge design.

GBpass is built so that only you can read what is inside your vault. Your data is encrypted on your device before it ever leaves it, and the keys that unlock it stay with you. This overview walks through the pieces that keep your account safe and links to the full details on our security page.

The building blocks

A few layers work together to protect your account. Here is what each one does:

  • keyA two-part key. Your vault is unlocked by two things together — your Master Password and your Secret Key. Neither one is enough on its own. See how the two-part model works and learn more in Master Password and Secret Key.
  • lockMaster Password. Only you know it, and it is never sent to our servers. Details on the Master Password.
  • shield_lockSecret Key. A 34-character key that is unique to your account. It is kept on your devices and in your Recovery Kit. Details on the Secret Key.
  • encryptedAES-256 encryption. Your data is encrypted with AES-256, a standard trusted to protect the most sensitive information. See AES-256.
  • fingerprintSRP sign-in. When you sign in, you prove your identity without ever sending your password over the network. See SRP sign-in.
  • verified_userZero-knowledge design. We only ever store encrypted data, and only you can decrypt it — so your vault stays private even when it syncs between devices. See zero-knowledge and how sync works.
key How your vault unlocks
smartphone Everything happens on your device
lock
Master Password
Only you know it
add
shield_lock
Secret Key
34-char, on your devices
Combine
lock_open_right
Your vault
encrypted AES-256
check_circle Unlocked
Syncs
cloud
GBpass servers
•••• only encrypted data — unreadable to us
Two secrets combine to unlock your vault — and only on your device.

Why encryption happens on your device

Everything you save is encrypted right on your phone before it is stored or synced. Because your Master Password and Secret Key never leave your control, the copy of your data that reaches our servers is unreadable to anyone but you. Even if someone gained access to that stored data, they would see only encrypted content — no logins, notes, or attachments in the clear.

check_circleYour vault is encrypted end-to-end — only your devices can unlock it.

What this means for you

Strong privacy comes with one important responsibility. Because of the zero-knowledge design, GBpass cannot see or reset your Master Password — if it is lost and you have no way back in, we cannot recover your vault for you. This is exactly what keeps your data private, and it is why your Recovery Kit matters so much.

warning A lost Master Password cannot be recovered by GBpass. Keep your Recovery Kit somewhere safe and offline so you can always get back into your account.

Want the full technical picture? Read the complete security page for a deeper look at each protection described above.

Still need a hand?

Browse the Help Center FAQ or contact our support team.

Previous arrow_forward Delete your account