ZZPass uses zero-knowledge, end-to-end encryption. Your data is encrypted on your device before it goes anywhere. We can't read it. Apple can't read it. Nobody can — except you.
Four cryptographic guarantees, applied at every layer of the system. The rest of this page is the technical detail behind each one.
We never see your passwords. All encryption happens on your device, with keys we never receive.
Every credential, note, and attachment is AES-256-GCM encrypted in your vault.
Data is encrypted before it reaches iCloud. CloudKit only ever sees ciphertext.
Shared items use end-to-end ECIES encryption. Only invited members can decrypt.
When you create your ZZPass account, your primary password is transformed into a 256-bit encryption key using an intentionally slow process that makes brute-force attacks impractical. This key encrypts and decrypts everything in your vault. It never leaves your device. We never see it.
| Algorithm | PBKDF2-SHA256 |
| Iterations | 650,000 |
| Salt | 128-bit · SecRandomCopyBytes |
| Output | 256-bit symmetric key |
| Storage | Device Keychain only |
| Comparison | Constant-time SHA-256 hash |
OWASP recommends at least 600,000 PBKDF2-SHA256 iterations. ZZPass uses 650,000.
Every password, username, note, TOTP secret, and attachment in your vault is encrypted with AES-256-GCM before being stored. Both confidentiality and integrity — nobody can read it, nobody can tamper with it undetected.
ZZPass uses Apple's CloudKit for sync — no proprietary servers. Sensitive data is encrypted at the application layer; CloudKit only stores and transports ciphertext.
Trust model: Even if iCloud were compromised, your vault would remain encrypted. The decryption key exists only on your devices — never in transit, never in the cloud, never on our servers.
Encryption is foundational — but a vault is only as safe as the device unlocking it. ZZPass stacks five layers of defense before your data is ever decrypted.
Re-keying the entire vault is a delicate operation. ZZPass's migration is atomic, fault-tolerant, and never leaves data unrecoverable — even if something goes wrong mid-flight.
Safety net. If the process is interrupted (crash, power loss), ZZPass keeps the backup key so no data is ever lost. Items encrypted with either key decrypt transparently until the migration completes.
Your Secret Key is a human-readable encoding of your encryption salt. Combined with your primary password, it's everything you need to recover your account on a new device. Print it, store it safely, and you'll never be locked out.
| Format | Z1-XXXX-XXXX-XXXX-XXXX |
| Encodes | 128-bit random salt |
| Pairs with | Your primary password |
| Stored on ZZPass servers | Never |
For technical evaluators — every algorithm, key size, and standard ZZPass relies on. No custom cryptography, no third-party libraries.
This isn't a policy.
It's math.
Without your master key, your data is indistinguishable from random noise.
Every security architecture has a boundary. Here's what ZZPass defends — and what remains your responsibility as the device owner.