The short version
ZeyroVault derives every encryption key from your passphrase inside your browser. The key never leaves the device, so a server cannot read your plaintext or your key, and nothing is kept for later.
Security
A plain account of what the browser tools defend against, and what they do not.
Last updated: October 2026
What this protects against
- Storage that keeps your data in the clear.
- A service operator reading your plaintext or your key.
- Interception of data that would otherwise travel in readable form.
What this does not protect against
Client-side encryption protects data at rest and in transit. It cannot protect a device that an attacker already controls.
- Malware or a keylogger on the device you use.
- Anyone who watches your screen or reads your clipboard.
- A hostile browser extension with access to the page.
- A weak, reused or lost passphrase.
- Metadata such as file size and the time of an operation.
Standards
- AES-256-GCM for encryption, per NIST SP 800-38D and FIPS 197.
- PBKDF2-HMAC-SHA-256 for key derivation, per RFC 8018, and SHA-256 for hashing.
- No account, and no upload of plaintext or keys.
Reporting a security issue
Please report suspected issues by writing to legal@zeyrovault.com. A machine-readable contact block is published at https://zeyrovault.com/.well-known/security.txt.
Where your data goes
The tools run as static files in your browser. There is no application server that receives your input, so the data flow has fewer steps than a hosted editor.
- Step 1: you open the page; Cloudflare serves static HTML, CSS and JavaScript.
- Step 2: you type or select a file; the input stays in browser memory.
- Step 3: Web Crypto derives a key and encrypts locally; the result stays on your device until you download or copy it.
- Step 4: you share the output yourself; the recipient needs the passphrase, and no server holds a copy.
Verify the boundary yourself
Five minutes with the browser you already use is enough to test the main claim.
- Open DevTools and switch to the Network tab before you encrypt a test note.
- Confirm that no request body contains the note, the passphrase or the key.
- Disconnect the network and repeat the operation; the tool still works because the code is already loaded.
- Open the Application tab and check that the note is not in localStorage, sessionStorage or IndexedDB. The tools store preferences and cached app files, not your input.