Everything you save in MorphGate goes into your vault: hosts, keys, passwords, identities, groups, snippets, tunnels, VPN profiles, imported schemes, attachments and session logs. The vault is encrypted on your device before anything is written to disk or sent to a sync server.
The short version
- Your master password never leaves your device. MorphGate never sends it anywhere, sync servers included.
- The vault file on your disk holds only ciphertext. Hostnames, users, passwords and keys exist only inside encrypted items.
- A sync server, ours or yours, stores the same ciphertext. It can't read it, and it can't change an item without your devices noticing.
- If you forget your master password, only your recovery key gets you back in. Nobody else can.
How the keys fit together
- Your master password goes through Argon2id, a deliberately slow function (256 MiB of memory and three passes), to make a master key. The slowness is what makes guessing passwords expensive for anyone with a copy of your vault.
- From the master key, MorphGate derives two separate keys: one that protects your account keys, and one that proves to a sync server that you know the password. The server only ever stores a slow hash of the second one, so it can't work back to the first.
- Your account keys are a random key pair for encryption and one for signing. They are stored wrapped (encrypted) under the key from your password, and a second time under your recovery key.
- Each vault has its own random key. It is sealed to your account's encryption key. A team's shared vault has its own key too, sealed separately to each member.
- Each item is encrypted with its vault's key (XChaCha20-Poly1305), signed with the author's signing key, and padded so its exact size doesn't show.
This extra layer is why changing your master password is quick: MorphGate re-wraps your account keys, and no item has to be re-encrypted.
What protects each item
- Encryption: only someone holding the vault key can read an item.
- Binding: each item is tied to its vault and its id, so an item can't be swapped into another place without failing to open.
- Signatures: MorphGate checks every item's signature before it decrypts it. A tampered or swapped item fails loudly instead of being quietly skipped.
- Padding: items are padded to steps of 256 bytes, so their exact sizes are hidden.
When the vault is open
Unlocking derives the keys in memory. Locking drops every key and closes open terminals, file browsers, tunnels and VPNs. Secrets go one way inside the app: the interface passes passwords and keys into the encrypted core, and only learns back that something is saved, or a fingerprint.
Someone who steals your device while the vault is locked has only ciphertext. They can try to guess your master password offline, and Argon2id makes each guess slow. A long passphrase keeps that out of reach. Someone at your computer while the vault is unlocked can use what's in it, which is why auto-lock exists.
Checks against a dishonest server
- Rollback: each device remembers the newest revision of each vault it has seen. A server answering with an older one is treated as an error.
- Weak key settings: when you sign in, the server tells the app how to derive your keys. The app refuses settings below a safe minimum (64 MiB of memory, two passes), so a server can't make your password easier to guess.
- Keys the server hands out: in a team, the app uses a vault key only if it was signed by a member it has verified. A server can't slip in a key of its own. See Inviting and confirming members.
The building blocks
MorphGate uses audited Rust implementations of Argon2id, HKDF-SHA256, XChaCha20-Poly1305, X25519 and Ed25519. The full design is in the sync and crypto spec in the MorphGate repository (docs/sync-crypto-spec.md). See also What the server can and cannot see.