A technical explanation of the encryption model, what the server can and can't see, and how licensing prevents tampering — for the security-conscious reader who wants specifics, not marketing copy.
When enabled, a symmetric key (Ku) is derived from your master password on your device — it never leaves your browser. That key wraps a per-team key (Kteam) and per-entry keys (Ke), which encrypt the actual password data before it's ever sent to the server. The server only ever stores ciphertext plus wrapped keys; it has no way to derive Ku or decrypt anything, even with full database access.
This means: if your server is compromised, breached, or the admin account itself is hostile, zero-knowledge entries remain unreadable. The tradeoff is real too — there is no password recovery if you forget your master password and haven't set up organization-level recovery in advance.
Breach checking never sends your actual password anywhere. Your browser computes a SHA-1 hash of the password locally, then sends only the first 5 characters of that hash to a public breach-checking API. The API returns a list of hash suffixes matching that prefix, and the match is confirmed entirely in your browser. Nobody — not the breach-checking service, not Jadex — ever sees the full password or full hash.
When an admin approves an access request, the server generates a random 24-byte token tied to a single reveal. The recipient's link decrypts and displays the password exactly once — the server marks it viewed immediately and permanently rejects any further attempts at that token, even if the link is reused or shared further.
License keys are signed with Ed25519 — a modern elliptic-curve signature scheme — so they can't be forged without the private signing key, which never leaves our infrastructure. On activation, your server computes a hardware fingerprint (hostname, platform, CPU count, MAC addresses, hashed) and binds the license to it locally. An optional online activation server can additionally track and revoke licenses remotely, but the software works fully offline by default.
The server generates a self-signed TLS certificate on first run so traffic between your browser and your own server is encrypted, even on your local network. Sessions support WebAuthn passkeys and TOTP two-factor authentication, and the same account can be signed in on multiple devices simultaneously without any device being silently logged out — each device gets its own independent session.
If you find a genuine security issue, email us directly — we'll take it seriously and respond promptly.
security@jadexvault.com