Cloud Protocol

Unlike traditional centralized password managers, the Keypher Cloud is not a database of your passwords. It is a relay network.

When you enable Cloud Sync, your local device acts as a sovereign node. It takes your raw vault, encrypts it using XChaCha20-Poly1305 with keys derived locally via Argon2id, and only then pushes the incomprehensible cipher-blob to the Cloudflare Edge.

Because the Cloud only ever receives the encrypted blob, Keypher operators, Cloudflare engineers, and potential malicious attackers cannot read your data. The server physically lacks the mathematical keys required to decrypt the vault.

The Keypher Browser Extension bridges the gap between your local encrypted vault and the web applications you use daily.

Once installed, the extension connects to your vault via a secure local context. It scans the current active tab and maps the domain to your encrypted records. When a match is found, it securely decrypts the specific credential exactly when needed.

We do not rely on standard DOM injection which can be scraped by malicious third-party scripts running on compromised websites.

• Shadow DOM Isolation: The extension injects its UI components into a closed Shadow DOM, making it invisible to page scripts.
• Direct Event Dispatching: Passwords are dispatched directly to the input fields simulating genuine user keystrokes, bypassing clipboard-sniffing attacks.
• Auto-Lock: The extension's memory is purged instantly upon closing the browser or after a predefined inactivity timer.