Encrypted before it leaves your device
Every password is sealed on your device first — our servers are never given a plaintext password to protect or lose.
How it works
See what actually happens to your passwords — without the jargon
No account, no server, and no support engineer ever sees your real passwords. Here's what happens behind the scenes for every core PassKub flow — and why it's built so a data leak can't expose what's inside your vault.
Your vault
Every entry is locked before it's ever saved
When you save a password, PassKub turns it into unreadable ciphertext right there on your device, using a key only your keypass can unlock. Nothing is written to disk until it's already locked.
- 1Unlock your vault key once with your keypass — it's kept only in memory.
- 2Every entry is sealed with AES-256-GCM before it touches storage.
- 3Close the app, and the key disappears — only ciphertext remains on disk.
PassKub never stores your keypass, so nobody — including us — can unlock your vault without it.
Sync Vault
Your cloud backup travels locked — and stays that way
Premium sync copies your vault between your own devices through our servers, but it never unlocks along the way. Our servers only ever handle a sealed box they can't open.
- 1Your device seals the vault with your key before it uploads anything.
- 2The sealed copy passes through PassKub's servers as ciphertext only.
- 3Only another device signed in with your same keypass can unlock it.
Even if our servers were ever breached, there's nothing readable to steal — only sealed ciphertext.
Device A
Sync (ciphertext only)
Device B
Team Sync Vault · Business
One shared vault, opened only by keys your team members hold
A Business team vault has a single shared vault key, but that key is individually sealed for each teammate using their own personal key. Our servers store the sealed copies only — never a usable key.
- 1Each teammate has their own personal key pair, generated on their device.
- 2The shared vault key is sealed separately for every member who's added.
- 3Only that member's own device can unseal their copy — nobody else's key works.
Remove someone from the team and their key stops opening anything new — there's no shared master password to leak.
Shared vault
Family Sync Vault
The same trusted design, built for your household
Family Sync Vault uses the exact same sealed-key model as Team Sync Vault — every family member gets their own personal key to the shared vault, so passwords can be shared at home without a single point of failure.
- 1Every family member signs in with their own account and key pair.
- 2The shared family vault key is sealed individually for each of them.
- 3Adding or removing a family member never exposes the vault key itself.
One shared vault, every member's own key — no single password everyone has to protect.
Family vault
Local Quick Fill
Autofill that never leaves your device
Local Quick Fill types a saved password into another app or browser on the very same device. There's no network involved at all, so there's nothing in transit to intercept.
- 1Press your shortcut and pick the entry you want to fill.
- 2PassKub unlocks just that one entry, in memory, for an instant.
- 3The credential is typed into the field and immediately cleared from memory.
No internet connection is used or required — the credential never leaves your computer.
Your vault
Login field
Request Quick Fill
A one-time, encrypted handoff between two of your devices
Need a password on a second device without opening your whole vault there? Request Quick Fill sends just that one credential, end-to-end encrypted, and it's approved by matching a shape — never by typing anything a relay could read.
- 1Device A asks for one credential; Device B sees the request.
- 2You confirm by tapping the matching shape shown on both screens.
- 3The credential is sealed, relayed, unlocked only on Device A — then the request is gone for good.
The relay only ever sees a sealed, one-time envelope it cannot open — and it expires within minutes even if unused.
Device B requests
Relay (sealed only)
Device A unlocks
Why you can trust this
Designed so a data leak can't expose your passwords
Zero-knowledge by design
We store ciphertext, sealed keys, and public keys only — there's no plaintext copy anywhere in our systems, even for support.
Nothing lingers
Quick Fill requests and sync hand-offs are one-time and short-lived — expired data is deleted, not kept "just in case."
You hold the only key
Your keypass is never sent to us and never stored anywhere. That's the trade-off of true zero-knowledge security — even we can't recover it for you.