How it works
The flow of your information
Every secret follows the same safe path. Here's what happens at each step — and where your data is, and isn't, in the clear.
Your device
Plaintext lives here only. It's encrypted in your browser with AES-256-GCM before anything is sent.
password: ••••••••
→ encrypt()
DynoLocker server
blindStores only encrypted blobs, hashes and salts. No keys, no plaintext — nothing readable.
9f2a1c…e7b4 (AES-GCM)
iv: 3b8f…d1
The lifecycle of a secret
From the moment you create a credential to the moment a teammate reads it back.
- 1
Set up your vault
Generate your 12-word recovery phrase. It appears once, on a timed screen — write it down and store it offline. We keep only a hash.
- 2
Add a credential
As you save a password or secret, it's encrypted right there in your browser with AES-256-GCM and a fresh random IV.
- 3
Sync securely
Only the encrypted blob travels to our servers. The plaintext never leaves your device.
- 4
Access on demand
Data is decrypted locally, only after you unlock with your phrase and any required second factor.
- 5
Share with your team
Grant role- and permission-based access to folders and items — still end-to-end encrypted throughout.
- 6
Stay accountable
Every access is recorded in a tamper-evident audit log, so nothing happens unseen.
Start protecting your credentials today
Set up your encrypted vault in minutes. Your data is encrypted on your device before it ever reaches us — that's a promise backed by math, not policy.