Security
For a vault product, trust is the product
Here's exactly what Cloakspire encrypts, how, and - just as important - what it honestly doesn't protect against.
What's protecting your vault
Argon2id key derivation
New vaults derive a random master key wrapped by your password using Argon2id (memory-hard, resistant to GPU cracking) - not a directly-derived key, so changing your password never re-encrypts your data.
Fernet authenticated encryption
Every secret value is encrypted with Fernet (AES-128-CBC + HMAC-SHA256) from Python's audited cryptography library. Tampering with the database is detected, not silently ignored.
Metadata is encrypted too
Not just values: variable names and notes, snapshot contents, and server labels/hosts/usernames are all ciphertext at rest. A stolen database file reveals structure, not your infrastructure map.
TOFU SSH host-key pinning
The first connection to a server shows its SSH host key fingerprint for you to confirm, exactly like OpenSSH. If a later connection presents a different key, you get a hard warning naming both fingerprints - never a silent reconnect.
A real recovery kit
A one-time, high-entropy recovery code generated at setup can reset a forgotten master password without losing data - the industry-standard pattern, not 'forgot your password? start over.'
Clipboard auto-clear
Copied secrets clear from your clipboard automatically after a short delay, so they don't linger for the next paste in an unrelated window.
Honest limitations
Every security tool has a threat model. Here's ours, stated plainly rather than left for you to discover.
- Python can't reliably wipe decrypted strings from memory, so a memory dump of a running, unlocked vault could expose secrets. This is inherent to Python and shared by nearly every Python security tool.
- Single factor only: the master password (plus an optional recovery code) is the only thing standing between an attacker and your vault. No 2FA or hardware key support yet.
- Nothing protects against malware or a keylogger already running on your machine - true of every local vault, including the big commercial ones.
- There is no built-in multi-device sync. Copying the vault file yourself (or via your own sync tool) is currently the only way to use it on a second machine - a deliberate trade-off of staying fully offline, not an oversight.