Key derivation
Argon2id turns the master password into cryptographic material suitable for protecting the vault.
Security
Local protection, explained without fog.
KPassword is designed to keep credentials on the user’s computer, with authenticated encryption and risk-reduction mechanisms.
Authenticated vault
AES-256-GCM with AAD protects confidentiality and integrity of stored data.
Controlled evolution
cryptoVersion 2 allows the vault format to migrate with better predictability.
Technical summary
- Local vault, with no account and no mandatory sync.
- Argon2id for deriving the key from the master password.
- AES-256-GCM with AAD for authenticated vault encryption.
- cryptoVersion 2 for controlled evolution of the cryptographic format.
- Encrypted backups and pre-migration backup.
- Signed updater, automatic lock and revised clipboard handling.
No hype
What KPassword does not promise
Absolute security does not exist. The app aims for good practices, careful updates and transparency. Protection also depends on a strong master password, the state of Windows, safe backups and user habits.