Security
Built so that a computer can be trusted, and nobody can read your secrets. Trustwelt included.
A managed computer is protected by its own system, not by a browser setting someone can change. Your organisation shares the use of a login without ever handing out the login. Your own passwords are encrypted on your own computer before anything else happens. Every decision about access is written down. This page explains what that means, and how you can check it.
- Nothing decryptedweb rules read a site's name, never what you read or type
- Never on a screenno screen of ours shows a stored password, ever
- On your computeryour vault is encrypted before anything leaves it
- Open sourcethe vault that holds your passwords, for you to read
For you
Your passwords are yours. We cannot read them, and we never need to.
Trustwelt Desktop keeps your logins, one-time codes, notes and cards in one encrypted file on your computer. The key is made from your master password on that computer and goes nowhere. What reaches Trustwelt, if you sign in at all, is ciphertext.
A master password, and a Secret Key
Your master password unlocks the vault. The Secret Key, created on your computer and kept in its key store, means a copy of your file is useless to anyone who stole it, even with your password.
A recovery kit you print
Lose your master password and the kit opens your vault so you can set a new one. Trustwelt keeps no copy of it. Without your password or your kit, nobody can open your vault, including us.
Only the site you allowed
The browser extension fills a login only on the site it belongs to, and only after you allowed that site. A lookalike page gets nothing, because the match is strict and checked twice.
Cards without the security code
Your cards are filled at checkout from the vault, after your master password. The security code is never stored anywhere, so a copy of your vault cannot pay with your card.
Nothing leaves without your consent
Sync, shared collections and an encrypted copy of a card happen only when you ask for them, item by item where it matters, and a consent can be withdrawn.
Your activity stays yours
Trustwelt Desktop keeps a record of what it read in and used, encrypted with your vault key. On a laptop your employer manages, they see counts of your personal activity at most. Never a site, never an item.
The cryptography
What protects you, and how.
These are the algorithms in the product, with their parameters, and what each one does for you. The first five rows are open source and can be read line by line.
| What | How | What it means for you |
|---|---|---|
| Your vault key | Argon2id | Derived on your computer from your master password, with 512 MiB of memory by default and a fresh salt per vault. It is never written to disk and never sent anywhere. |
| Your vault | XChaCha20-Poly1305 | One encrypted file, titles and websites included, with a fresh nonce on every save and the whole file authenticated. A wrong password, a wrong key file and a tampered file give one and the same error. |
| The Secret Key | 128 bits, in your system key store | A second ingredient of the key that a copy of the file does not have, so the file cannot be attacked with the master password alone. A key file of your choice can be a third. |
| The browser extension | X25519 · XChaCha20-Poly1305 | Paired once by a code you compare on both sides. Every message after that is encrypted, numbered and bound to its connection, and the extension receives one login for the page you are on. |
| Sync and sharing | X25519 · XChaCha20-Poly1305 | Every item travels in its own sealed envelope. A collection you share has its own key, wrapped for each member's computers and rotated when someone leaves. |
| Your account password | Argon2id | Hashed on our side, never logged, never compared in the clear. Sign-in and reset are rate limited. |
| Your second step | TOTP · WebAuthn | An authenticator app, a security key or a passkey on every sign-in. Recovery codes are shown once, stored hashed, and each works once. |
| Your devices | Certificate · Ed25519 | Each enrolled computer has its own certificate and key and signs everything it sends. A stolen password alone never looks like your laptop. |
| Your organisation's audit | SHA-256 hash chain | Every record bound to the one before. A changed or missing record shows, and nobody at Trustwelt can edit it either. |
All traffic to Trustwelt is encrypted in transit with TLS 1.2 or 1.3.
Who holds which key
Your keys, your shared keys, and what we hold.
The key to your vault exists only on your computers. The key to a collection you share exists only on its members' computers. What Trustwelt holds is sealed envelopes, the site and username of company logins, and counts: nothing that opens anything.
For your organisation
Share the use of a login. Never the login.
A company login is listed by its site and username. Its password is sealed for the computers of the people who may use it, where Trustwelt Desktop fills it under a one-time permission. Nobody, not the person, not an admin, not Trustwelt, ever sees it.
Who may do what
Roles with a ceiling per kind of login, from viewing to managing, and a grant on top for each person or team. People ask for access with a reason, and the managers of that login decide.
Finance holds the cards
A custodian scope gives a set of logins or cards to the people responsible for them. Seal it, and every other admin sees a name and a count. Changing its custodians needs a second custodian to agree.
A card nobody can read
A company card is filled at checkout under a one-time permission. Its number is never shown to the person paying, and the amount goes into your audit.
Leavers are out at once
Remove a person from a group or a scope and the keys are rotated for everyone who stays. Revoke a computer and the organisation's items leave it at its next request.
Personal stays personal
Your people keep their own logins and cards in their own vault. The organisation never sees them, and never sees where they are used, even on a computer it manages.
Sign-in the way you already do
Admins sign in at your organisation's own address with a password and a second step, or through your identity provider. An IP allowlist can close the console to everywhere else.
Your computers
A login proves who. The computer proves where from.
Passwords get phished and second factors get approved by mistake. Trustwelt gives each enrolled computer its own identity, reads its state, and decides on the server whether access should be trusted. On a managed computer, protection is part of the system itself.
- Its own identityEach computer has a certificate and a key of its own and signs everything it sends. A stolen password alone never looks like your laptop.
- Unknown is not compliantDisk encryption, firewall, secure boot: a signal the agent cannot read stays unknown, and policy treats it that way.
- Remediation, not a remote shellWhen a computer falls short, the person is shown the fix. The platform can send a registered, signed action to that one computer, and nothing else.
- Revoked means goneRevoke a lost laptop in the Portal and it is out at its next request: no sync, no company logins, no trust.
- Protection the person cannot switch offOn a managed computer Trustwelt starts with every session and comes back if ended. The web rules are applied by the computer, in every browser and application; a second browser or a private window does not go around them. Nothing is decrypted to do it.
- Stopped only on purpose, and on recordOnly an administrator of the computer can pause protection, and the organisation's console shows that it was. A computer that stops reporting is shown as such, and an e-mail goes out.
Your account
Signing in, and staying in control of it.
- A password hashed with Argon2id and a second step on every sign-in: an authenticator app, a security key or a passkey. Changing the second step asks for a current code first.
- Recovery codes for the day you lose your phone, shown once and each good for one use.
- Every session listed with its browser and time. Sign out of one, or out of everywhere, in one click.
- Registration and password reset answer the same way whether or not an address has an account, so neither tells anyone who is a customer.
- Trustwelt Desktop signs in through your browser and never sees your account password. Each computer gets its own grant, which you can revoke.
What we never ask for
Trustwelt never asks for your master password, your Secret Key or a recovery code, by email or on the phone. No screen of ours shows a stored password. If something does, it is not us.
Your organisation's audit
A record that nobody can quietly change.
- Every use of a company login or card, every privileged change and every refused attempt is written down: who, what, when, from which computer, and for a card, the amount.
- Records are append-only and each is bound to the one before. A removed or altered record breaks the chain and shows.
- The audit is yours: filter it, export it, set its retention. Nobody at Trustwelt can edit it.
Web protection sees addresses, not pages
When your organisation uses web protection, what it can see of a person's browsing is a blocked or warned site: the address, when, which rule and which computer. Allowed browsing is not recorded unless the organisation switches on the full activity log, and then its people are told. Nothing on a page — no form, no password, no content — is read, on any plan. A person sees in their own Portal exactly what their organisation can see of them.
Recovery
A way back in, without a back door.
Your vault
Your printed recovery kit opens it when the master password is lost. Trustwelt cannot, because we hold no key to it.
Your account
Recovery codes sign you in when your authenticator is gone, and you set it up again from there.
Your organisation's scopes
On Enterprise, the organisation holds its own recovery key for custodian scopes, kept offline as a code. Using it is a two-person step.
Check it yourself
Evidence over badges.
- The vault inside Trustwelt Desktop is Vault Lite, free software. The vault format, the browser protocol and the threat model are written down next to the code.
- Every release of the vault builds in a container, so you can build it on your own machine and compare.
- We publish the data classes, where each one lives and who can read it, on the data protection page.
- As independent assessments complete, we publish their scope here. We do not display a badge we cannot show you the evidence for.
Found a problem?
Tell us through the security report page, not the general contact form.