UniPass
Download
Security

Security you can reason about.

UniPass is built so the things that matter most — your master password, your Secret Key and your encryption keys — never leave your Mac. Here is exactly how it works, and where its limits are.

Security is our first priority. Responsible disclosure is welcome.

Key hierarchy

Every key is derived or unwrapped on your Mac.

Two secrets only you hold are stretched into a master key. Everything else is unlocked from it, one layer at a time.

Master password Only in your head
Secret Key 128‑bit · in your Keychain
Account email Part of the salt
Argon2id · 64 MiB · 3 passes · 4 lanes
Master key 256‑bit · in memory only while unlocked
HKDF‑SHA256
Vault key Random 256‑bit · stored only wrapped
Item keys One random 256‑bit key per item
XChaCha20‑Poly1305 · 192‑bit nonce
Encrypted items Opaque, tamper‑evident
PBKDF2‑SHA256 · 600,000
Auth hash Proves it’s you, reveals nothing
Never leaves your Mac Sent to UniPass
Primitives

Boring, well‑studied cryptography.

PurposeAlgorithmParameters
Key derivation Argon2id 64 MiB memory, 3 iterations, 4 lanes; salt = SHA‑256(email ‖ Secret Key)
Second secret Secret Key 128 bits from the OS random generator, created on your Mac
Item encryption XChaCha20‑Poly1305 Random 256‑bit key per item, 192‑bit random nonce, versioned envelope
Key wrapping HKDF‑SHA256 + XChaCha20‑Poly1305 Vault key wrapped by a key derived from the master key; item keys wrapped by the vault key
Sign‑in proof PBKDF2‑HMAC‑SHA256 600,000 iterations over the master key; the server stores a further hash
Local database SQLCipher Whole‑file encryption, keyed from your master password and Secret Key
Memory Zeroization The master key is wiped from memory when UniPass locks
Visibility

What we can see. What we can’t.

With sync on, our servers see

  • Your account email and device names
  • Encrypted blobs, their sizes and revision numbers
  • Timestamps, deletion and favorite flags, folder IDs
  • Your IP address, transiently, in access logs

We can never see

  • Your master password or Secret Key
  • Your Recovery Code or any encryption key
  • Item titles, URLs, usernames, passwords and notes
  • Attachments, folder names and one‑time‑code secrets

Without sync, nothing from your vault is sent to UniPass at all.

Policy

Threat model and disclosure

How UniPass protects your data

  • Encrypted at rest: the local database is encrypted with SQLCipher; individual vault records use XChaCha20-Poly1305. The key is derived from your master password with Argon2id.
  • Zero-knowledge sync: optional cloud sync uploads only opaque ciphertext. The server stores no keys and cannot decrypt your vault.
  • Credentials stay local: the browser extension reaches your vault only through the desktop app over your OS's Native Messaging channel — never over our network.
  • Anti-phishing autofill: matches the registrable domain (eTLD+1), so look-alike domains don't receive your credentials.
  • Brute-force resistance: Argon2id KDF plus rate limiting (by IP and account) and progressive lockout on the sync service.
  • Supply-chain integrity: macOS release builds are code-signed and Apple-notarized; the extension is distributed through the Chrome Web Store.

Threat model

Threats we defend against

  • An attacker who obtains your device files (cloud backup, stolen drive) — the vault database is encrypted.
  • An attacker who intercepts network traffic during sync — end-to-end encryption plus TLS.
  • An attacker who controls the sync server — the server cannot decrypt any vault content (zero-knowledge).
  • Other local users on the same machine — no access to the vault's encryption keys.
  • Online brute-force of login — Argon2id KDF, dual-dimension rate limiting, progressive lockout.

Threats we cannot defend against

  • Your master password itself being compromised (social engineering, shoulder-surfing, keyloggers).
  • Malware running with administrator/root privileges on your device — no password manager can defend against this.
  • Zero-day operating-system vulnerabilities — we can only minimize attack surface.

Reporting a vulnerability

Please do not report security issues through public GitLab/GitHub issues. Disclose privately:

  • Email: business@loxnet.io
  • Subject prefix: [SECURITY]
  • Please include: affected version/platform, vulnerability type, reproduction steps (PoC welcome), potential impact, and any suggested fix.

Our commitment

  • Acknowledge your report within 24 hours.
  • Provide an initial assessment (reproducibility, severity) within 72 hours.
  • Patch CRITICAL/HIGH issues as fast as engineering allows and ship a fix release.
  • Credit you in the release notes (unless you prefer to stay anonymous).
  • We will not pursue good-faith security research.

FAQ

What if I forget my master password?

We cannot retrieve your existing master password. If you enabled a Recovery Code before losing access, that code can re-wrap the same local encryption keys under a new master password and Secret Key, preserving the encrypted vault. We never receive the Recovery Code or plaintext keys.

Without a valid Recovery Code, the email reset flow creates a new encryption identity and an empty vault. It permanently deletes the old encrypted vault and related server-side data; 2FA is still required when enabled. Neither UniPass nor support can decrypt or restore the deleted data.

Do you collect usage data?

No telemetry, crash reports, or usage analytics. With cloud sync enabled we store vault ciphertext and sync metadata (account email, device identifiers, version numbers); nothing else is uploaded. See our Privacy Policy.