What encryption algorithm does PassNote use?

PassNote encrypts vault fields on your device using authenticated AES-256-GCM encryption before synchronization. Decryption occurs strictly on your device using your master encryption key.

Does CraftX Tech store or have access to my master encryption key?

No. Your encryption key is stored in protected local device storage and is never included in the synchronized cloud vault record.

Does Password Health send my passwords to an external server?

No. Password Health evaluates weak and reused passwords locally on your device without transmitting plaintext secrets to external breach-checking services.

ZERO-KNOWLEDGE BY DESIGN

Encrypted on your device.
Readable only by you.

PassNote is built around a straightforward rule: your secrets belong to you. Logins, payment cards, Wi-Fi passwords, and private notes are encrypted on your phone or tablet with AES-256-GCM before they ever touch the cloud.

AES-256-GCM Authenticated Encryption Master Key Never Leaves Device PIN & Biometric App Lock

Download PassNote Free Read Privacy Policy

On-Device Encryption Pipeline AES-256-GCM

Your Master Key & Local Secure Storage

Your encryption key is stored exclusively in protected OS storage (iOS Keychain / Android Keystore via FlutterSecureStorage) and volatile memory while unlocked.

Client-Side AES-256-GCM Sealing

Every password, card number, Wi-Fi credential, and note is encrypted and authenticated with a unique initialization vector (IV) and authentication tag before leaving your device.

Encrypted Cloud Sync & Offline Cache

Firebase Cloud Firestore receives only the ciphertext payload over HTTPS. Even in the event of a cloud breach, ciphertext cannot be decrypted without your master key.

DEFENSE IN DEPTH

Six layers of protection
for everyday peace of mind.

Security in PassNote is not a single toggle. It combines authenticated cryptography, hardware-backed device storage, and strict data boundaries.

Authenticated AES-256-GCM

PassNote uses 256-bit Advanced Encryption Standard in Galois/Counter Mode (AES-256-GCM). Unlike unauthenticated block modes, GCM verifies integrity on every decryption so tampered ciphertext is immediately rejected.

Zero-Knowledge Key Ownership

CraftX Tech never receives your master encryption key during account sign-in or vault synchronization. Only you hold the key needed to unlock and read your synchronized vault records.

PIN & Biometric App Lock

Protect your unlocked session with a dedicated PIN and OS-level biometric authentication (Face ID, Touch ID, or Android BiometricPrompt) paired with configurable auto-lock timers when you leave the app.

Offline-First Availability

Your encrypted vault remains accessible on your device even without an internet connection. View logins, copy Wi-Fi passwords, or edit notes offline; encrypted updates synchronize automatically once you reconnect.

Local-Only Password Health

The PassNote PRO Password Health dashboard inspects weak and reused passwords strictly in local device memory. Your passwords are never uploaded to third-party breach databases.

Strict Ad-Free Security Screens

On the free tier, PassNote enforces strict security guardrails: ads are never displayed on Sign-In, Master Key Setup, App Lock, or Add/Edit Password screens. Upgrading to PRO removes ads entirely.

TRANSPARENT DATA BOUNDARIES

What stays on your device
vs. what syncs.

You shouldn’t have to guess what a password manager stores. Here is an exact breakdown of how PassNote handles each type of data.

Data Type	How It Is Protected	Where It Lives	Can CraftX Tech Read It?
Master Encryption Key	OS Hardware-Backed Secure Storage (Keychain / Keystore)	Device Only	Never. Never transmitted or stored in the cloud.
Passwords, Cards, Wi-Fi & Notes	Client-side AES-256-GCM encryption before sync	Encrypted Cloud + Local	No. Stored only as unreadable ciphertext.
Biometric Templates (Face / Fingerprint)	Processed strictly by iOS / Android Secure Enclave	OS Hardware Only	Never. PassNote only receives pass/fail status.
Password Health Analysis	Evaluated in volatile memory during unlocked session	Device Memory Only	Never. Never sent to external breach services.
Account Identifier & Optional Key Hint	HTTPS / TLS transport & Firebase Authentication	Account Record	Used for sign-in, sync routing, and support verification.