- Your vault is a single encrypted file stored in the app's private folder. Each entry is sealed with XChaCha20-Poly1305; the vault key is wrapped by a key derived from your master password with Argon2id (at least 64 MiB of memory and 3 passes, tuned to your device).
- The master password is never stored. Quick unlock (Face ID, Touch ID, fingerprint, PIN) uses the device's secure hardware where available and is off by default.
- IvyKey contains no networking code. On iPhone, Mac, Android, Windows and in the Linux Flatpak it also has no internet permission; the Linux RPM runs without a sandbox, like other Fedora apps.
- Merging sync copies only accepts files authenticated with your own vault's key; IvyKey never asks for another device's password to merge.
- Keys are held in locked memory and wiped when the vault locks; copied passwords are cleared from the clipboard and kept out of clipboard history where the system allows.
- Linux packages and update repositories are signed by VNET LIMITED; your system refuses unsigned or tampered updates.
What IvyKey cannot protect against
A device already compromised by malware or a keylogger, or someone with administrator access. The full list of residual risks is in the user guide.
Independent review
IvyKey has not yet been independently reviewed. Until it has, please do not rely on it as your only copy of important passwords. (After the review: reviewer, date, scope and report summary.)
Reporting a vulnerability
Email support@xlab.nz with "Security" in the subject. Please give us reasonable time to fix the issue before disclosing it.