Security

Your vault is locked before it leaves your device.

How TermRoad protects your hosts, keys and passwords, exactly what our server can and can't see, and what happens if something goes wrong.

1 · Your Mac
Encrypted here
Each item is stored encrypted and decrypted in memory only while it's shown. The vault key, your Secret Key and your sign-in token live in the macOS Keychain, not in a file.
→
2 · In transit
HTTPS, already sealed
Everything goes over HTTPS, and the vault inside it is already encrypted.
→
3 · Our server
Stored, unreadable
We store the encrypted vault plus the few details listed below. The key to open it never reaches us.

Connection logs are encrypted too, and never leave your Mac. Encrypted exports are a file you keep yourself, readable only with the one-time code shown when you make it.

Your two secrets

Your password is mixed with your Secret Key before anything is sent to us. Even with a stolen copy of our database, every password guess would also need a Secret Key we never had.

Master password

You choose it. At least 10 characters, checked on your device against common passwords and ones built from your email address. It never leaves your device.

Secret Key

128 random bits your device creates at sign-up. You save or print it on your Secret Key kit, and the app goes on only once you've typed its last four characters back. Each new device asks for it once, then keeps it in the Keychain.

Example only, not a real key. Yours is different.

H1-K3YD00-26YRKJ-ZH6WA-MY040-BYJNY-245Q0D

What our server can and can't see

Can't see

Your hosts, passwords, keys, identities or snippets
What kind of item each one is, or which vault it's in
Your master password or Secret Key
Your connection logs, which never leave your Mac

Can see

Your email address, to sign you in and send codes
How many items you have, their encrypted sizes, when each changed, which device changed it, and whether it was deleted. Size can hint at kind: a key is usually larger than a snippet.
Your device names, when each signed in and last synced, and the IP address your app connects from
A sign-in key worked out from your password and Secret Key, stored hashed. It can't be turned back into either of them.
Your vault's key, locked with a key only your password and Secret Key together can make, so we can't use it

Can't change

An item, or invent one, without your app noticing: a tampered item won't decrypt, and the app sets it aside and tells you
An item's details: its timestamp, device and deleted flag are sealed with it

The limits

What a compromised server could still do

We'd rather you knew.

Hold back recent changes, or hand a device an older version of an item (including an older deletion). It couldn't make up new contents.
Delete your encrypted vault, or stop syncing it. Your devices keep their own copies, and an encrypted export doesn't depend on our server at all.
Sign in as you, if it recorded your sign-in key. That only gets the encrypted vault it already had.

Checking the servers you connect to

Every connection checks the server's host key against your known hosts. The first time, TermRoadshows the fingerprint and asks you. If a known key changes, the connection stops. There's no setting to skip it, and jump hosts are checked the same way.

Locking the app

Off by default, like your other Mac apps: TermRoad opens straight into your vault, and your Mac's own login protects it. Lock it any time with ⇧⌘L.

Turn on Lock automatically in Settings and it locks after 15 minutes without use (or 1, 5 or 60, as you choose), and when your Mac sleeps or its screen locks. You then unlock with Touch ID or your master password. The password is asked for every 14 days, after fingerprints are added or removed, and, if you choose, after TermRoad restarts. Sessions keep running while it's locked, unless you choose to disconnect them.

If you lose a device

Anyone who can use your device while it's unlocked can open your vault, especially with locking off.

01On another device, sign the lost one out in Settings › Account › Devices. It can no longer sync.
02Change your master password (Settings › Account).
03Treat the vault as exposed: the lost device still holds the vault's key, so change the server passwords and replace the SSH keys it held.

If you forget your password or lose your Secret Key

We can't decrypt your vault, so we can't recover it for you. What you can do depends on whether one of your devices is still signed in.

If you've lost your password or Secret Key and no device is signed in, nobody can decrypt your vault.

Reset your password from a signed-in MacComing
See or reprint your Secret KeyComing
Start again with an empty vault, after a seven-day wait you can cancelComing

Keep an encrypted export. Settings › Export and import makes a file that, with its one-time code, you can import even into a brand-new account. It doesn't depend on our server. Keep the file and the code somewhere safe, apart from each other.

Deleting your account

Settings › Account › Delete account asks for your master password, then deletes your vault, your devices and your account from our server. It can't be undone, so make an export first if you might want your vault back.

The details

For anyone who wants to check our working. All of the vault's encryption uses libsodium, a widely used open-source library, and we don't write our own cryptography.

TermRoad hasn't been independently audited yet. When it is, we'll publish the report here.

Found a problem? See reporting a security problem.

Password stretching: Argon2id · 64 MiB · 3 passes
Secret Key mixing: BLAKE2b → separate keys for signing in and for the vault
Item encryption: XChaCha20-Poly1305 · random 256-bit vault key · fresh random nonce per save
Authenticated with it: ID · timestamp · device · deleted flag
Weak settings: Refused, so a server can't make your password cheaper to guess
Conflicts: The later change wins; the device whose change lost keeps its version for 30 days (Settings › Replaced versions), encrypted, never sent to us