Security & Architecture
Audit Report
A comprehensive technical review of Keypher’s zero-knowledge cryptography, edge infrastructure, and anonymity models.
1. Executive Summary
Keypher is engineered from the ground up as a strict zero-knowledge ecosystem. The fundamental philosophy driving the architecture is that data cannot be leaked if it is never possessed. This audit verifies that all encryption happens entirely client-side. The cloud infrastructure acts purely as a dumb synchronization layer for encrypted bytes, rendering any potential server breach cryptographically useless to attackers.
2. Cryptographic Standards
Key Derivation (Argon2id)
The user's Master Password is run through the Argon2id hashing algorithm, the winner of the Password Hashing Competition. This algorithm is explicitly designed to be highly resistant to GPU cracking and side-channel attacks.
- Local derivation only
- Memory-hard constraints
Payload Encryption (AES-GCM)
All vault items are symmetrically encrypted using AES-256-GCM. Galois/Counter Mode ensures not only complete confidentiality but also cryptographic integrity, preventing cipher-text tampering.
- 256-bit encryption
- Cryptographic authentication tag
3. k-Anonymity Password Monitoring
To detect compromised passwords without exposing user data to third-party APIs, Keypher implements the k-Anonymity privacy model via the Have I Been Pwned (HIBP) API.
The Anonymity Flow
- 1The extension hashes your password locally using SHA-1.
- 2It sends only the first 5 characters of the hash to the API. Your password never leaves your device.
- 3The API returns hundreds of known leaked hashes starting with those 5 characters.
- 4Keypher checks locally if the full hash matches any in the list.
Conclusion: Keypher provides proactive dark-web breach monitoring with mathematically proven zero-knowledge transmission.
4. Edge Network Infrastructure
Keypher avoids traditional monolithic servers. The entire backend runs on Cloudflare Workers and Cloudflare D1 databases.
Because the cloud nodes execute at the edge (literally milliseconds away from the user), synchronization operations avoid long, vulnerable network hops. The database holds only non-identifying IDs, Argon2 verification parameters, and the fully encrypted AES-256-GCM vault blob.
Even in the event of a catastrophic edge node compromise, the attacker obtains nothing but cryptographically secure noise.
Audit Status: Verified Secure
The architecture is fundamentally sound. Keypher fulfills its promise of delivering consumer-friendly password management without sacrificing digital sovereignty.
Launch Secure Cloud