Built so we can’t look.

Two secrets, both needed

Your vault opens with your master password, which only you know, and a Secret Key: 128 random bits generated on your first device. The Secret Key is shown once, in your Emergency Kit, then kept in your operating system’s keystore. It is never sent to us.

Your password is stretched with Argon2id (64 MiB, three passes) and combined with the Secret Key to make your Account Unlock Key. That key wraps the key of each vault, and the vault keys encrypt your items.

The second secret is what makes a stolen database useless. An attacker with a copy of our servers has a salt, an SRP verifier and ciphertext. Guessing your password gets them nothing without 128 bits they don’t have.

Every item sealed on its own

Each item is encrypted on your device with XChaCha20-Poly1305. Its id, its version and whether it is deleted are bound into the encryption, so the server can read that an item changed but cannot move one item’s contents onto another, roll it back to an older version, or mark it deleted without your devices noticing.

Changing your master password re-wraps a few keys instead of re-encrypting your whole vault.

What the server sees

Ciphertext, the order changes arrive in, their sizes, and when and from where you sync. It never receives your password, your Account Unlock Key, a vault key, or any plaintext: not titles, not URLs, not tags. Search runs on your device, which is why there is no server-side search.

Sign-in uses SRP-6a, so your password never crosses the network, not even to log in, and a compromised server cannot replay a login elsewhere. Each device has its own identity, which is how you can see your devices and sign one out.

Your encrypted vault and your website account are stored in the European Union, under Cloudflare’s EU data jurisdiction.

On your screen

• Screen-capture protection is on by default. On macOS and Windows the operating system excludes vault windows from screen sharing, recordings and screenshots. Where a platform can’t do that, Remem tells you instead of implying protection it doesn’t have.
• The menu-bar panel never shows a code. It shows time remaining. The code is fetched at the moment you copy it, so it is never on screen there.
• The QR reader only reads 2FA. When you scan a code off your screen, anything that isn’t an otpauth:// payload is discarded before any part of the app sees it.
• Secrets are masked by default everywhere they appear.

In the terminal

The remem command holds no keys. It asks the desktop app, which checks which program is asking before it answers. Approvals are per program and per item, expire, and end the moment the vault locks. Every request lands in the access log, allowed or refused.

remem run masks secret values in a program’s output. That is a safety net, not a guarantee: a tool that transforms a secret before printing it can get past it. SSH keys sign inside the agent and are never handed to the command line.

Locking

The app locks after five minutes idle and the browser extension after fifteen, and the app also locks when your computer sleeps. Only something you do resets the timer: a code counting down on screen doesn’t, and neither does a web page that keeps reloading itself.

Found a problem?

Please tell us privately first. Our vulnerability disclosure policy says how to reach us and what to expect, and security.txt has the contact details in the standard format.

Remem is open source under the GNU Affero General Public License v3.0, so the code that does all of this is there to read.