Embedded Files
Why Isovault is Built
Why Isovault is Built
IsoVault was built to provide a truly offline, local-first alternative to cloud-based password managers. As digital accounts continue to grow, users need a secure way to manage credentials without relying on external servers or third-party access.
IsoVault was built to provide a truly offline, local-first alternative to cloud-based password managers. As digital accounts continue to grow, users need a secure way to manage credentials without relying on external servers or third-party access.
Many solutions depend on cloud synchronization or proprietary infrastructure. IsoVault removes that dependency entirely. Your data stays on your device, encrypted at rest, decrypted only in memory while unlocked, and automatically cleared when the session ends.
Many solutions depend on cloud synchronization or proprietary infrastructure. IsoVault removes that dependency entirely. Your data stays on your device, encrypted at rest, decrypted only in memory while unlocked, and automatically cleared when the session ends.
Security is not an add-on feature in IsoVault—it is the foundation of its design.
Security is not an add-on feature in IsoVault—it is the foundation of its design.
How it works
How it works
IsoVault uses a zero-knowledge security architecture to protect your credentials. Your Master Password is never stored. Instead, it is processed through PBKDF2-HMAC-SHA256 (250,000+ random iterations with a unique salt) to derive a secure cryptographic key.
IsoVault uses a zero-knowledge security architecture to protect your credentials. Your Master Password is never stored. Instead, it is processed through PBKDF2-HMAC-SHA256 (250,000+ random iterations with a unique salt) to derive a secure cryptographic key.
The app uses a dual-key system:
The app uses a dual-key system:
- A Key Encryption Key (KEK) derived from your Master Password.
- A randomly generated Data Encryption Key (DEK) that encrypts your actual credentials.
All stored data is encrypted using AES-256-GCM, which provides both confidentiality and built-in tamper detection.
All stored data is encrypted using AES-256-GCM, which provides both confidentiality and built-in tamper detection.
Only encrypted data (ciphertext, IV, and authentication tag) is stored on disk—never plaintext passwords.
Only encrypted data (ciphertext, IV, and authentication tag) is stored on disk—never plaintext passwords.
Without the correct Master Password, the encrypted vault is cryptographically inaccessible.
Without the correct Master Password, the encrypted vault is cryptographically inaccessible.
Security Architecture & Encryption Protocol
Security Architecture & Encryption Protocol
Its primary purpose is to ensure that your sensitive data (usernames and passwords) is mathematically inaccessible to anyone without the Master Password—including the developer and the OS itself.
Its primary purpose is to ensure that your sensitive data (usernames and passwords) is mathematically inaccessible to anyone without the Master Password—including the developer and the OS itself.
Below is the technical breakdown of how the application secures data at rest and in motion (memory).
Below is the technical breakdown of how the application secures data at rest and in motion (memory).
1
The "Zero-Knowledge" Foundation
The "Zero-Knowledge" Foundation
The most critical aspect of this system is that your Master Password is never stored.
The most critical aspect of this system is that your Master Password is never stored.
If a hacker steals your phone or dumps the database files, they cannot find your password because it simply isn't there. Instead, the application stores a cryptographic derivative of your password.
If a hacker steals your phone or dumps the database files, they cannot find your password because it simply isn't there. Instead, the application stores a cryptographic derivative of your password.
2
The Key Hierarchy (KEK & DEK)
The Key Hierarchy (KEK & DEK)
The application uses a dual-key architecture to allow you to change your password without re-encrypting your entire vault.
The application uses a dual-key architecture to allow you to change your password without re-encrypting your entire vault.
- The Key Encryption Key (KEK) - The "Key to the Key"
When you enter your password, the app converts it into a cryptographic key using PBKDF2 (Password-Based Key Derivation Function 2).
When you enter your password, the app converts it into a cryptographic key using PBKDF2 (Password-Based Key Derivation Function 2).
- Algorithm: PBKDF2-HMAC-SHA256
- Iterations: 250,000 (High computational cost prevents brute-force attacks) + random iterations.
- Salt: A random 16-byte value is added to the password before hashing.
This ensures that even if two users have the same password, their derived keys are completely different, preventing "Rainbow Table" attacks.
This ensures that even if two users have the same password, their derived keys are completely different, preventing "Rainbow Table" attacks.
- The Data Encryption Key (DEK) - The "Master Key"
This is a randomly generated 32-byte secret created when you first install the app.
This is a randomly generated 32-byte secret created when you first install the app.
- This key encrypts your actual data (accounts, usernames, passwords).
- The DEK is encrypted using the KEK and stored in the SecurityKeys database box.
In summary: Your Password unlocks the KEK → The KEK decrypts the DEK → The DEK decrypts your Data.
In summary: Your Password unlocks the KEK → The KEK decrypts the DEK → The DEK decrypts your Data.
3
Data Encryption Standard (AES-GCM)
Data Encryption Standard (AES-GCM)
Once the application has the decrypted DEK in memory, it uses it to read and write your credentials.
Once the application has the decrypted DEK in memory, it uses it to read and write your credentials.
Algorithm: AES-GCM (Advanced Encryption Standard with Galois/Counter Mode) using 256-bit keys.
Algorithm: AES-GCM (Advanced Encryption Standard with Galois/Counter Mode) using 256-bit keys.
Why GCM? Unlike older modes (like CBC), GCM provides Authenticated Encryption. It generates a "Message Authentication Code" (MAC). If a malicious actor modifies even one bit of the encrypted file on your disk, the decryption will fail immediately rather than producing garbage data. This detects tampering instantly.
Why GCM? Unlike older modes (like CBC), GCM provides Authenticated Encryption. It generates a "Message Authentication Code" (MAC). If a malicious actor modifies even one bit of the encrypted file on your disk, the decryption will fail immediately rather than producing garbage data. This detects tampering instantly.
4
Runtime Security (Memory Management)
Runtime Security (Memory Management)
Security is not just about storage; it's about how data lives in the Random Access Memory (RAM).
Security is not just about storage; it's about how data lives in the Random Access Memory (RAM).
- Ephemeral Decryption
The plain-text password and the DEK exist in memory only while the vault is unlocked.
- Automatic Wiping
When the SessionTimeoutService triggers (due to inactivity or backgrounding the app), the dek variable is ereased.
The Garbage Collector then clears the key from memory.
Once locked, the app strictly requires the Master Password again to regenerate the keys.
Page updated
Google Sites
Report abuse