The server literally cannot read your vault
Little Vaulty is built on zero-knowledge, end-to-end encryption. Your passwords and notes are scrambled on your device before anything is sent to our servers. We store only sealed, encrypted blobs — never the contents inside. That is not a marketing claim; it is how the architecture works.
See it yourself
Watch your text get encrypted right here, in your browser, before anything would be sent anywhere:
What this means in plain words
Think of our database as a warehouse of locked boxes. Each box holds your encrypted vault data. The only key is your master password, which is created and used entirely on your device — it never reaches us. Even if someone copied our entire database, they would get only unreadable ciphertext. Without your master password, those boxes cannot be opened.
The trade-off you must understand
- Because only you ever hold the key, if you forget your master password, your vault cannot be recovered — by anyone, including us.
- There is no “reset password” email that restores your vault, no admin override, and no back door. That absence is not a missing feature — it is what makes the product trustworthy.
- What to do about it: remember your master password; keep your 2FA backup codes safe; on eligible plans, regularly create and keep encrypted export backups — a one-time export is not enough, and a stale backup can be as risky as none; understand that the only path after a lost master password is to burn the account and start fresh — the old vault is destroyed, never recovered.
Formal statement: Terms of Service — master password clause
What we can and cannot see
We can see
- Account email and username
- Recovery email (contact on file only)
- IP addresses and device labels
- Security-event metadata (sign-ins, session activity)
- Encrypted ciphertext and sync timestamps
We cannot see
- Vault item contents (passwords, URLs, custom fields)
- Secure notes and their contents
- Your master password
- Your vault encryption key
How your account is protected beyond encryption
Encryption is the wall. Around it, we add defence in depth: two-factor authentication (TOTP), a trusted-device window that skips 2FA for up to 12 hours, account lockout after failed attempts, session idle timeout, HTTPS everywhere, and EU-hosted infrastructure (Supabase on AWS eu-west-1, Ireland). These protect your account and our systems — they do not replace zero-knowledge encryption, and they do not let us read your vault.
Learn more
For the full data picture — sub-processors, retention, GDPR rights — read our Privacy Policy.