Security model
How we keep your credentials safe
No hand-waving. Here is exactly what protects your data, the technology behind it, and what each layer means for you in practice.
Your device
Plaintext lives here only. It's encrypted in your browser with AES-256-GCM before anything is sent.
password: ••••••••
→ encrypt()
DynoLocker server
blindStores only encrypted blobs, hashes and salts. No keys, no plaintext — nothing readable.
9f2a1c…e7b4 (AES-GCM)
iv: 3b8f…d1
Zero-knowledge by design
Zero-knowledgeAll encryption and decryption happens in your browser using the Web Crypto API. The server never sees your plaintext, your recovery phrase, or your encryption keys — only encrypted blobs, hashes and salts.
What this means for you: Nobody at Bizhub can read your data. A breach of our servers exposes unreadable ciphertext, not your secrets.
Authenticated AES-256-GCM encryption
AES-256-GCMEvery secret and file is encrypted with AES in GCM mode using a 256-bit key and a unique random 12-byte IV per item. GCM is authenticated encryption, so any tampering with the ciphertext is detected and rejected.
What this means for you: Identical passwords never look the same when stored, and corrupted or altered data simply won't decrypt.
Hardened key derivation
PBKDF2 · 100k · SHA-256Encryption keys are derived from your recovery phrase using PBKDF2 with SHA-256, 100,000 iterations, and a per-account salt — then imported as a non-extractable AES-GCM key.
What this means for you: Guessing your phrase by brute force is deliberately slow and expensive, even with specialized hardware.
Keys wrapped inside keys
Envelope encryptionYour data-encryption key (DEK) is itself encrypted with a separate storage key derived from your phrase hash and salt before it is ever cached locally. Keys are non-extractable and never written in plaintext.
What this means for you: Even local storage on your own machine never holds a usable key in the clear.
A recovery phrase only you know
12-word phrase · bcryptOn setup you generate a 12-word recovery phrase shown exactly once on a timed, auto-hiding screen. We store only a bcrypt hash of it and verify you saved it by asking for words at random positions.
What this means for you: You are the only person who can unlock your vault — by design, we could not recover it for you even if asked.
Passkeys & two-factor unlock
WebAuthn / 2FASensitive folders can be locked behind a second factor — a 6-digit TOTP code or a hardware-backed Passkey using WebAuthn / FIDO2.
What this means for you: Even with your password, an attacker can't open protected folders without your physical key or device.
Secure-context enforcement
Secure contextThe app verifies a secure HTTPS context and Web Crypto availability before any cryptographic operation, and refuses to run otherwise.
What this means for you: Encryption can't be silently downgraded or run over an insecure connection.
Encrypted file vault
Encrypted filesFiles are encrypted client-side with AES-256-GCM before upload, with an allow-list of file types and a size limit enforced in the browser.
What this means for you: Certificates, keys and documents are protected with the same zero-knowledge guarantee as your passwords.
Complete audit trail
Audit trailEvery meaningful action — create, read, copy, view, move, login, logout — is recorded per entity with audit-level logging.
What this means for you: You always know who accessed what and when, across your whole team.
Start protecting your credentials today
Set up your encrypted vault in minutes. Your data is encrypted on your device before it ever reaches us — that's a promise backed by math, not policy.