Security & zero-knowledge privacy
Even we can't read your vault.
That's not a slogan — it's the architecture. WiseEnding is built so your most sensitive secrets are encrypted on your device before they are ever stored or sent. Our servers only ever hold the locked box. This page explains exactly how, in plain words — and just as honestly, where the limits are.
The one-sentence answer
Your passwords are scrambled into unreadable ciphertext on your phone or laptop, using AES-256-GCM, before they ever leave it. What reaches WiseEnding is only the scrambled version — so neither we, nor anyone who ever breached our servers, can turn it back into words.
The key that unlocks it is derived from your passkey (your face, fingerprint or device PIN) and never leaves your device. There is no "master key" and no backdoor.
What "zero-knowledge" actually means here
"Zero-knowledge" is used loosely across the industry, so let's be precise about what it means at WiseEnding:
- Encryption happens on your device, not our servers. The moment you save a password, your browser scrambles it using the Web Crypto API — the same audited cryptography your bank uses — before a single byte is transmitted.
- We never hold the key. The vault's encryption key is itself locked ("wrapped") using a secret derived from your passkey. That secret is generated inside your device's secure hardware and never travels to us, in any form.
- We store only ciphertext and public values. What sits in our database is the encrypted blob, the wrapped keys, and random salts. Every one of those is mathematically useless without your passkey or recovery code.
- There is no employee access. Because we have no key, there is no admin panel, no support tool, and no engineer anywhere at WiseEnding who can read your secrets — even if compelled to.
The practical consequence: a breach of our servers is boring. An attacker would walk away with gigabytes of unreadable ciphertext and no way to open it. We could not help them — and we could not help ourselves.
The journey of one secret
Follow a single password from your keyboard to your family, and you'll see there is no moment where it sits anywhere readable:
You type a secret on your device
Say the login for your bank. You enter it into a record on your phone or laptop, over HTTPS.
Locked first, then sent. Before it leaves your device it is already encrypted — never the other way round.
Your browser scrambles it (AES-256-GCM)
Using the vault's Data Encryption Key (DEK) and a fresh random 96-bit IV, your browser turns the password into ciphertext like 8f3a91c….
AES-GCM also authenticates. If anyone tampers with even one bit, decryption fails loudly — never a silent, corrupted read.
Only the ciphertext reaches our servers
We store the locked box alongside the wrapped key and a salt. Nothing readable ever touches our database.
If our servers were stolen tomorrow, the thief gets gibberish — and there is nothing here to bribe, threaten, or subpoena into plaintext.
Your passkey unlocks it, on your device only
When you open the vault, your device re-derives the key from your passkey's secret and decrypts — entirely in memory, in your browser tab.
The plaintext exists only in that tab. It is never re-uploaded, never logged, never cached anywhere readable.
Your family opens it with their own code
When the time comes — living access you grant now, or the Legacy Heartbeat after you're gone — each person uses a one-time access code you gave them to unwrap the key and read only what you chose for them.
No account, no app, no passkey of their own. The least we can ask of someone who is grieving.
The keys — and why there are three independent ways in
A vault you genuinely can't open is only acceptable if you can always get back in, and your family can when it matters. So the same vault key (DEK) is wrapped separately for three independent unlock paths. Lose any one and the others still work.
Your passkey
Your face, fingerprint or device PIN, via WebAuthn. It produces a high-entropy secret inside your device's secure hardware that never leaves it — nothing to memorize, nothing to type, nothing that can be phished over the phone. This is how you unlock the vault day to day.
A one-time recovery code
Shown once when you enable the vault (a 23-character code like ABCDE-FGHJK-…). It's an independent second key, device-independent — the way back in if you lose every device you own. Write it down and keep it somewhere real: a safe, with your will. We can't reissue it.
A per-person access code
You mint a fresh one-time code for each trusted person and hand it over yourself — in person, in an envelope, with your lawyer. The vault key is wrapped by a key derived from that code, and the code never touches our servers. They type it once, on the day it matters.
There isn't one — by design
Many services keep a recovery key that lets staff (or a hacker who breaches them) unlock everything. WiseEnding deliberately has none. The only keys are the three above, and two of them exist only in your hands. That's what makes "even we can't read it" a fact, not a promise.
A distinction worth knowing
Your recovery code is for YOU. Access codes are for FAMILY. They are completely separate keys. Your recovery code only ever unlocks your own vault; an access code only ever unlocks what you chose to share with that one person. Neither can be used for the other's job.
Sharing is not all-or-nothing. Anything you mark "Only me" is never sent to your family at all — not locked, not hidden, simply absent from what they receive. The private things stay private, permanently.
The exact cryptography (for the technical reader)
No hand-waving. Here's what's actually running, all of it client-side via the Web Crypto API:
- AES-256-GCM — authenticated encryption for both the vault data and the key-wrapping. Confidentiality and tamper-evidence in one primitive.
- HKDF-SHA256 — derives the key-encryption-key (KEK) from the passkey's PRF secret, with an app-specific salt and info string.
- PBKDF2-SHA256, 310,000 iterations — derives KEKs from the human-typed recovery code and each access code, slowing offline guessing to a crawl.
- Random salts and IVs — every wrap and every ciphertext uses fresh randomness from
crypto.getRandomValues, so no two encryptions repeat. - Key material stored = safe. The server holds the DEK only in its wrapped forms (passkey-KEK, recovery-KEK, one per access code), plus salts and the public half of a future device-sharing keypair. All useless without the corresponding secret.
Everything degrades gracefully: if a device doesn't support WebAuthn/PRF or Web Crypto, the app says so honestly and the account keeps working on Google sign-in alone — the passkey is a progressive upgrade, never a barrier.
Layers of protection, beyond the encryption
Zero-knowledge encryption guards your passwords. Around it, several other layers guard the rest of your life:
Google sign-in is the front door
Authentication is handled by Google — we never see or store your Google password. Sign-in proves who you are; it is entirely separate from the encryption keys that protect your secrets.
Owner-only at the rule layer
Firestore security rules enforce that your data is readable only by you, at the database level — not just hidden in the UI. Trusted-person access is granted explicitly and is time- and role-gated by the same rules.
A one-tap privacy switch
Every financial figure can be masked (●●●●) with a single tap — so anyone glancing at your screen in a meeting or a café sees nothing. On in public, off in private.
A gentle safeguard, not a countdown
The Legacy Heartbeat only begins the handover you chose after a long, clearly-signalled period of silence — with reminders and a grace window. Never a dramatic timer, never a surprise.
HTTPS everywhere
All traffic between your device and our servers is encrypted in transit over TLS, on top of the end-to-end encryption of the secrets themselves.
Your files, your folder
Documents and video messages live in owner-scoped cloud storage, with the same owner-only rules. You can delete them at any time; deletion is real, not archival.
How your family gets access, when it matters
The hardest problem in legacy planning is this: a vault only you can open is a vault your family is locked out of forever. WiseEnding solves it without ever weakening the "we can't read it" guarantee — and without asking a grieving person to install an app or create an account.
- You mint a one-time access code per person. In My People, one button per person. We take your vault key, lock a copy of it with a brand-new code, and show you that code once. You hand it over yourself — the code never touches our servers, which is exactly why we can promise no one here can read your vault.
- Each code opens only what you chose for that person. Per-person, per-field control: your spouse might see everything, your children a redacted version. What you marked "Only me" is never sent at all.
- They type it once, on the day it matters. When your vault opens to them — living access you granted, or the Heartbeat after you're gone — there's one box asking for the code. They type it and what you left them appears. Forgiving, too: it accepts lowercase, missing dashes, stray spaces.
- Two moments, your choice. You don't have to wait for the Heartbeat. Grant living access to your closest circle right now — and re-seal it whenever you like. The same codes power both.
Why we don't seal to a server-held secret
A tempting shortcut is to encrypt your family's copy to something the server already knows (like an invite token). We refuse: anything the server holds can be stolen with it, which would quietly break the zero-knowledge promise. Instead, the key is sealed to a code that exists only on paper, in your hands — so a server breach can never unlock your family's access either.
Honest limits — what we can't protect you from
Real security means telling you where the walls end. These are the trade-offs of a vault we genuinely cannot open:
Read this before you trust it
- Lose both your passkey and your recovery code, and the encrypted secrets are gone for good. Not "hard to recover" — gone. That is the unavoidable, deliberate price of a vault with no backdoor. Keep your recovery code somewhere real.
- Anyone holding an access code can read what you shared with that person. It is a spare key — give it the same thought. If someone loses theirs, you can issue a new one, but only while you're here to do it.
- "Details" are not passwords. Anything you type into a record's Details box (account numbers, where the deed is kept, instructions) is shared as readable text with the people you choose. Only the Usernames & passwords box is zero-knowledge encrypted. Put secrets there deliberately.
- Zero-knowledge applies to your secrets, not to metadata. Like every service, we can see account-level facts (that an account exists, when it last signed in). We can't see what's inside the vault.
- Without a passkey, your account still works — you just can't store passwords. Google sign-in plus the Legacy Heartbeat still let your family receive everything else you chose. We simply refuse to save passwords unencrypted.