1. Data Sovereignty
Zero Lock is built on the principle of Absolute Sovereignty. Our platform serves as an encrypted bridge between your local device and cloud persistence, ensuring that your most sensitive secrets are never exposed to the clear-web. We do not track, monetize, or analyze your data.
2. Argon2id Key Derivation
Unlike standard managers, Zero Lock uses WebAssembly Argon2id and a unique, cryptographically secure random salt generated on your device. This memory-hard security derivation happens only once per session to create a localized Session Key. This makes GPU brute-force attacks mathematically infeasible while maintaining lightspeed performance.
3. Localized AES-256
Every secret is encrypted LOCALLY using your Session Key before leaving your device. Zero Lock uses the industry-gold standard AES-256. Your plaintext passwords, usernames, and site URLs NEVER touch our servers; only a fully encrypted, unrecognizable payload is transmitted to the cloud.
4. Cloud Persistence (Firebase)
Zero Lock utilizes Google Firebase Cloud for global data persistence. Crucially, the data stored in the cloud is 100% encrypted. Zero Lock developers, Google, and even the platform itself cannot read your data. Without your unique local Master Key, the cloud storage contains nothing but undecipherable noise.
5. Zero-Knowledge session
Your Master Key is never stored in any database. We store only a non-reversible SHA-256 cryptographic hash for identity verification. Once your session ends (tab close or logout), the local Session Key is cleared from memory. Zero Lock is a true Absolute Zero-Knowledgeenvironment.
6. Account Provisioning (PII)
To create your account and enable cross-device sync, we collect your Email Address via Google Firebase Authentication. This email is strictly used for account provisioning and logging in. It is the only piece of non-encrypted personal information we store, and we do not use it for marketing or tracking.