We built a vault we cannot open.
Strongroom follows the Bitwarden model. Your secrets are encrypted in your browser with keys that come from your master password. Our server stores and syncs ciphertext, and nothing more.
You choose a master password
It is typed into your browser and never sent anywhere. Not to us, not to your admin.
stays on your device
Your browser turns it into a key
The password is stretched 600,000 times so guessing it is slow and expensive.
PBKDF2-SHA256 · 600k
Secrets are locked before they leave
Every login, 2FA secret and note is encrypted on your device. The server only receives ciphertext.
AES-256-GCM
Sharing hands over a locked key
Each client has its own key, sealed separately for each person who works on that client.
one key per client
What our server sees
- Your name, email and role
- Client names, statuses, pages and transcripts
- Encrypted vault items it cannot open
- Who opened, revealed or copied what, and when
What it never sees
- Your master password
- The keys that unlock a vault
- Any password, 2FA secret or vault note
- Which site a vault item is for
From your password to a saved login.
Every step is done with the browser’s built-in WebCrypto. Here is what is made, and where it lives.
- Your browser only
Master password
Typed into your browser. Never stored, never sent.
- Your browser only
Master key
Derived from the password with PBKDF2-SHA256, 600,000 rounds.
- Sent, then hashed again
Sign-in proof
A one-way hash of the master key proves it is you. The server hashes it again before storing it.
- Stored encrypted
Your personal keys
A random key and a key pair, locked with your master key. The server keeps the locked copies.
- Stored encrypted
A key for each client
Random, and sealed with the public key of every person allowed into that client.
- Stored encrypted
Vault items
Each login, 2FA secret and note is encrypted with AES-256-GCM under its client’s key.
The rest of the safeguards.
Shared only with the people on a client
A client’s vault is opened by the people who work on it, and no one else. Access is set per client, as edit or view.
An access log for every secret
Every reveal and copy is recorded with who and when, so you can answer “who saw the Stripe password?” in seconds.
Auto-lock and 2FA sign-in
The vault locks itself when you step away, and accounts can require a second factor to sign in.
A database per workspace
Each workspace has its own subdomain and its own isolated database. Agencies never share tables.
Adams never sees passwords
The assistant reads clients, statuses, pages and transcripts. The vault is out of its reach because it is encrypted with keys only you hold.
Trash before delete
Deleted items go to the trash first, so a slip of the mouse is not a lost login.
The trade-off, honestly
Because we never hold your master password or your keys, we cannot recover a forgotten master password. If you lose it, a workspace admin resets your account and your teammates share each client’s vault with you again. Choose a passphrase you will remember, and keep it somewhere safe offline.
The parts of Strongroom that are not in the vault (client names, statuses, pages, transcripts) are stored on our servers so that your team and Adams can search and read them. They are kept in your workspace’s own database and are never shared with other workspaces.
Found a security issue? Please tell us through zyntlow.com/contact and we will get back to you.
Give every client one strongroom.
Set up your workspace in a couple of minutes. Starter is free; Team and Agency come with a 14-day trial and no card.