Arisrv Pass: your vault is encrypted before it leaves your device

Arisrv Pass derives your encryption keys from your master password on your device with Argon2id. Item names, URLs, usernames, passwords and notes are encrypted before they leave your device.

Keys that stay with you

Your master password is turned into keys on your device with Argon2id; the password itself never reaches our servers. Item names, URLs, usernames, passwords, notes, two-factor secrets and even vault names are encrypted before they are uploaded.

Vaults and sharing

Each vault has its own key, so sharing a vault with family or a team does not expose your other vaults. Shared vaults support owner, admin, writer and reader roles, enforced by the server.

Emergency access

You can let a trusted contact request read-only access to chosen vaults. Access is granted only after a waiting period you choose (from one hour to 90 days), or earlier if you approve it.

Breach checks

Breach checks send only the first five characters of a password's hash — never the password or the full hash.

Unlocking

On the web you can unlock your vault with a passkey that supports the WebAuthn PRF extension. On Windows you can use Windows Hello. Signing in to Pass with a passkey is supported; Pass does not yet act as a passkey manager for other websites.

What our servers can see

Item types, counts, timestamps, flags such as "has a two-factor code", and the member lists of shared vaults.

Platforms

The same vault syncs between the web app and the Windows app; the Android app is in testing. iOS is not available yet, and the browser extension is not published yet.