Security

Zero-knowledge by design

Your master password never leaves your device. It's stretched with Argon2id into a master key; separate sub-keys are derived for each purpose with HKDF-SHA256, and every item is sealed with AES-256-GCM before upload. We cannot decrypt your data, and we cannot recover a forgotten master password.

What the server stores

• Your encrypted items, which it cannot read
• Your vault key, only in wrapped (encrypted) form
• Organising data needed to sync: random item ids, collection, timestamps, size, and which device wrote each item
• Your Google account id, email address, name and picture
• Sessions, stored only as one-way hashes, which expire after 30 days of inactivity and at most 90 days

Tamper-resistant sync

Each encrypted item is bound to its id, collection, timestamp and deleted flag, so the server can't swap items between records, replay an old version or forge a deletion without it being detected.

Autofill that resists phishing

Logins are offered only on the exact site or the exact app they were saved for, and Pearl Pass never submits a form for you.

On your phone

• Vault kept in the app's private storage, encrypted
• Fingerprint unlock backed by the phone's secure hardware
• Screenshots blocked; excluded from cloud backup
• Clipboard cleared after 45 seconds

Operational security

Account security events are logged with the time and IP address and deleted after 90 days. Database backups are kept for 14 days. There is no analytics or advertising code in the extension.

Report a vulnerability

Found a security issue? Email support@perlicom.com with the details. Please give us a reasonable time to fix it before disclosing it publicly.