End-to-end encryption, passwords, passkeys, MFA, and recovery.
Your live vault is protected by end-to-end, zero-knowledge encryption. It encrypts in your browser before upload, so HeirVault cannot decrypt it. HeirVault-assisted delivery stores a protected key for that beneficiary handoff only and transfers it after claim. That means assisted handoffs are not end-to-end to the beneficiary alone. Direct-account and owner-shared delivery keep the handoff key off HeirVault servers.
Our live vault cryptography is open source. The client-side live vault library is public at github.com/TrueWear/heirvault-crypto and on npm as @heirvault/crypto (Apache-2.0). The full product is not open source. Assisted delivery stores a protected handoff key and is not in that library. The library has not been third-party audited yet. See /security for the full trust boundary.
Yes. HeirVault uses one password to sign you in (via OPAQUE, without sending the cleartext) and to unlock vault encryption on your device. Compatible passkeys can also unlock the vault. Email codes sign you into the account only and never unlock the vault. If you lose the password and your emergency kit, those contents cannot be recovered by us.
Prefer a long unique password over a short clever password. HeirVault requires at least 8 characters. Your password stays with you and unlocks the vault on your device. For passwords vs passwords and end-to-end encryption in plain English, open the Passwords page from the site footer or Security page. For Argon2id rate anchors and a browser-only lab, open Password strength.
Use your emergency kit and recovery phrase, which you store offline at setup. We cannot reset vault encryption for you. If both the password and recovery phrase are lost, vault contents cannot be recovered.
It includes a recovery phrase created when you set up your vault. Store it offline. It is how you recover vault access if you forget your password. See the emergency kit guide in Help for steps.
Passkeys let you sign in with Face ID, Touch ID, Windows Hello, a hardware security key, or a password manager. On HeirVault, adding a passkey also enrolls vault unlock when the authenticator supports it, so the same passkey can open your account and unwrap your vault key. Your password remains the root secret and recovery path.
Vault unlock needs WebAuthn PRF. Common options that usually support it:
Without PRF, that passkey can still sign you in, then you unlock with your password. We never receive your password or a clear vault key.
Honestly, yes: if someone tricks you into giving up your vault password, they can unlock your vault on a device they control. Mitigations include PRF passkeys so you unlock without typing the password each time, idle auto-lock that drops the key from memory, login session history on Pro and Shield, and on Shield a duress password that opens a decoy vault and alerts a trusted contact. None of these help if your real password was already captured.
If HeirVault servers were breached, attackers would get ciphertext, not readable docs and files from your live vault. Client-side encryption means the keys that decrypt your vault stay under your control, not in a database an attacker could dump. That is the practical reason we encrypt before upload, separate from everyday personal device risks.
After a period of inactivity (60 minutes by default; change this under Vault settings), or when you sign out, key material is cleared from browser memory and from any local device unlock wrap on that device. Idle locks the vault, not your account: you stay signed in, and your password opens the vault again. A normal page refresh keeps the vault unlocked until the lock window passes or you sign out.
On Pro and Shield, you can review recent sign-in sessions with device details and approximate location when geo enrichment is configured. Free plans do not include session history. Session metadata is for account security, not vault plaintext.
Optional authenticator MFA adds a one-time code from an authenticator app after password sign-in. Passkeys can skip this step. Backup codes recover MFA access if you lose the authenticator. MFA protects account sign-in. It does not unlock vault contents by itself.
Use account MFA recovery from the sign-in screen (Lost authenticator and backup codes?). Confirm the email we send, then wait a cooling-off period (about 72 hours). You can cancel during that window. When it finishes, MFA is disabled for account sign-in only so you can sign in and re-enroll. This never unlocks or decrypts your vault; you still need your password, a passkey unlock, or your emergency kit recovery phrase.
Hand off the master key and context without replacing your day-to-day password manager.
Store seed phrases and recovery notes so heirs can act without getting the keys today.
Store your recovery phrase offline so you can regain vault access if you forget your password.