AES-256-GCM for every vault item
Each item is sealed on your device with authenticated encryption. If anyone tampers with the encrypted data, it fails to open instead of being quietly accepted.
Security
Built so only you hold the key
Novash encrypts your vault on your iPhone or iPad before anything syncs. Here is exactly how it works, so you can check it for yourself.
At a glance
The facts behind the promise.
- AES-256-GCM, sealed on your device
- Argon2id: 64 MiB, 4 passes, 4 lanes
- Master password never leaves your device
- Second step on every new sign-in
- Database in Frankfurt, Germany
Cryptography
Algorithms you can look up
No vague slogans. We name the exact building blocks and settings, so anyone can check them.
Argon2id, set above OWASP minimums
Your master password is stretched with Argon2id using 64 MiB of memory, 4 passes, and 4 lanes. That makes every guess slow and costly for an attacker. The app refuses weaker settings.
A dedicated Rust crypto core
In the app, vault encryption, key derivation, and password generation run in compiled Rust, apart from the interface code, and that core wipes keys from memory once it is done with them. The AutoFill extension uses Apple’s CryptoKit for the same AES-256-GCM.
By design
What we cannot see, on purpose
A password manager that can read your secrets is a risk. Novash is built so that the keys to your vault stay with you, and only you.
Your vault is unreadable to us.
Your master password never leaves your device
To sign you in, your device derives a separate sign-in secret from it. The master password itself is never sent, and we store only a one-way hash of that secret.
We hold only the sealed copy
Your vault key is stored only in wrapped form, which your master password or your recovery key opens. What syncs is encrypted, so a copy of our database alone does not reveal your passwords.
Recovery stays in your hands
Your recovery key opens your vault if you forget your master password. Nobody else holds it, including us, so keep it somewhere safe, outside the vault.
Clear about what is not encrypted
To sort and sync your vault, a few item details are stored on our servers without encryption: type, chosen icon, folder, favorite, order, and dates. Your passwords, usernames, websites, and notes are always encrypted there.
Your account
Protection around the vault
Strong encryption is the core. These layers protect the account around it.
A second step on every new sign-in
After your password, Novash asks for a code sent to your email, or a code from your authenticator app if you turn one on.
Face ID and Touch ID, done strictly
The biometric unlock key lives in the Keychain on that device only, never syncs, and opens only with your current Face ID or Touch ID, never with the device passcode.
Every device, in your control
See each device signed in to your account and sign out any of them from the app.
Alerts when it matters
Get an email when your account is signed in on a new device, or when your vault is restored with your recovery key.
Infrastructure
Server rules that match the threat
Encryption on your device is not an excuse for loose rules in the cloud.
Strict database rules
Row Level Security keeps each account to its own data, and vault data also requires the second sign-in step to be complete.
A history that cannot be erased quietly
Security records, such as a new device or a master password change, are kept for 180 days, and the app has no power to delete them. A stolen session cannot cover its tracks.
Encrypted in transit
Every connection between the app and our servers uses HTTPS, on top of the encryption your vault already has.
Hosted in the EU
Your encrypted vault and account database live in Frankfurt, Germany.
Privacy
Breach checks that never reveal a password
Novash can tell you if a password has appeared in a known data breach, using Have I Been Pwned. The check runs only when you start it.
- Your password never leaves your device.
- Only the first five characters of its SHA-1 hash are sent.
- The answer is matched on your device, and responses are padded to hide how many matches came back.
Disclosure
Found a security issue?
Report it privately to security@novash.app. We work with researchers in good faith and protect them with a clear safe harbor.