AltF Vault

How AltF Vault encryption works

AltF Vault turns your master passphrase into a 256-bit key with PBKDF2-SHA-256 and 600,000 iterations, then encrypts the whole vault with AES-256-GCM in your browser before saving it to IndexedDB. The key is never stored or sent, so only someone with your passphrase can decrypt the vault or its backups.

  • Free, no account
  • Encrypted on your device
  • Works offline
  • Not yet independently audited

Step by step: from passphrase to ciphertext

  • You type a master passphrase. It stays in page memory only while it is being used.
  • The browser picks a random 16-byte salt and runs PBKDF2-HMAC-SHA-256 600,000 times to derive a 256-bit AES key.
  • Your items are serialised to JSON and encrypted with AES-256-GCM using a fresh random 12-byte IV.
  • The salt, iteration count and format version are authenticated alongside the data, so they cannot be swapped or weakened.
  • The encrypted record is saved in this browser's IndexedDB. Every save repeats the encryption with a new IV.

Why PBKDF2 and not Argon2

OWASP's Password Storage Cheat Sheet prefers Argon2id and lists PBKDF2-HMAC-SHA-256 at 600,000 iterations as the minimum when PBKDF2 is used. Browsers ship PBKDF2 natively in the Web Crypto API but not Argon2, which would need extra downloaded code. AltF Vault uses the native, well-reviewed primitive at the OWASP figure rather than bundling its own implementation.

What encryption cannot protect against

  • Malware or a malicious browser extension running while the vault is unlocked.
  • Someone using your device while it is unlocked. Use auto-lock.
  • A short or reused master passphrase. Use five or more random words.
  • Changed page code. A web app is delivered fresh on each visit, which is why AltFTool publishes its design here and why an independent audit is still a release gate.
Checking this browser for a saved vault...

How AltF Vault encryption works: questions and answers

Is AES-256 safe?

Yes. AES-256 is the standard symmetric cipher used by governments and banks, and no practical attack on it is known. The weak point of any vault is the passphrase and the device, not AES.

What does zero-knowledge mean here?

That AltFTool never receives your passphrase, key or decrypted data. In AltF Vault there is not even a server copy of the ciphertext.

How long would it take to crack my vault?

It depends entirely on the passphrase. Each guess costs 600,000 hash rounds, so a random five-word passphrase would take an attacker with large hardware far longer than any practical lifetime, while a common password could fall quickly.

Can I check the code?

Yes. The encryption runs in your browser, so you can inspect the page scripts and watch the network tab. The design on this page is the specification.

Vault guides and features

AltF Vault homeThe vault, how it is built, what it cannot do and the FAQ.Encrypted secure notesWrite encrypted notes in your browser: bank details, ID numbers, door codes and private lists, sealed with AES-256 on your device. Free and no sign-up.2FA recovery code storageStore two-factor backup and recovery codes encrypted on your device, tick off used codes and get warned when a set is running low. Free, no account.Password health checkFind weak, reused and years-old passwords in your vault, plus expired API keys and low recovery codes. Checked on your device, breach check optional.Encrypted backup and restoreDownload an encrypted backup of your AltF Vault, keep it in cloud storage or on a USB drive, and restore it on any device with your passphrase.Import passwords from CSVImport a password CSV from Chrome, Edge, Firefox, Safari, Bitwarden, 1Password or LastPass into an encrypted vault. Read on your device, never uploaded.Offline password managerA free offline password manager that runs in your browser with no account or cloud. Encrypted on your device, works without internet after loading.Master passphrase guideHow to choose a master password for a password manager: random word passphrases, how many words you need, how to memorise it and what to avoid.How to choose a password managerA checklist for choosing a password manager: audits, encryption, recovery, sync, offline access, export and cost, with an honest look at where AltF Vault fits.

Free tools that work with the vault

AltFTool stores nothing from your vault. It is encrypted and kept in your browser; the only optional network request is the k-anonymity breach check.