SECURITY

Built so that we cannot open it.

Every vault is sealed on your device, and opens only the way you set it to. Here is how, what we can still see, who checks our work, and how to tell us when something is wrong.

How sealing works

SAVING AN ENTRY

OPENpersonal/bank

1 · YOUR DEVICE

You type or generate it.

It is in the clear here, and only here.

SEALED · XCHACHA20

2 · TO EACH WAY IN

Sealed before it leaves.

KeyringD41C 6E07 … 52B8

DrawerF09A 3C61 … E4D2

Recovery sheet24 words, on paper

SEALED

3 · [REGION], EU

We keep one sealed blob.

Padded to a size, with its history. We hold no way in to it.

OPENING IT

4 · COMES DOWN SEALED

Sync brings the blob to your phone, laptop or browser.

5 · ITS RULE, MET

A YubiKey's touch, a password, your fingerprint: what its rule asks. A YubiKey's private key never leaves it.

6 · OPEN, THEN CLOSED AGAIN

It closes when you said it would: after one use, after a while, or at the end of the day.

Sharing

A shared vault opens with each member's own key, or only with two of three together if its rule says so. Someone who leaves is out at once, and it gets a new key without them.

Links and files

Sealed to a one-time key that lives in the link, after the #. Browsers do not send that part to us.

Machine keys

Software keys for CI: a vault or one folder of it, read-only, and they end. They need no touch. That is the trade-off.

WHAT WE HOLD

What we can see, and what we cannot

The left column is everything we hold about you. It is also all a lawful order could get from us.

Names are sealed too

An entry's name, its folder and how many there are travel inside the vault, sealed with the rest. We see a vault's size, to a bucket, and when it changed.

Where it lives, and under which law

WE CAN SEE

Your email address

Your workspaces and who is in them

How many vaults you have

When a vault changed, and its size

Which device synced, and when

The public half of your keys

Billing details, for a workspace

WE CANNOT

Passwords

One-time codes

Names, folders, every field

Card numbers, even fill-only

What a link or sent file holds

Your PIN

The private half of your keys

CLOSED SOURCE, CHECKED BY OTHERS

You cannot read our code. Others do, and say what they found.

wolpass is closed source. Independent firms test the apps, the sealing and our servers, with the code in front of them. We publish each report as they wrote it, findings and all.

BY	WHEN	WHAT THEY TESTED	FOUND · FIXED	REPORT
[AUDITOR]	[DATE]	Android and Linux apps, sealing, sync servers	[N] · [N]	PDF
[AUDITOR]	[DATE]	Website, browser extension, CLI, operator console	[N] · [N]	PDF

Next audit: [DATE]. Any open finding is listed in its report until it is fixed.

Every release is signed

Check a download before you install it. If the signature does not match this key, do not run it, and tell us.

Release signing key[FINGERPRINT]

Android app certificateSHA-256 [FINGERPRINT]

Kept onA hardware key, offline

CHECK A DOWNLOAD

$ gpg --recv-keys [FINGERPRINT]
$ gpg --verify wolpass-[VERSION]-linux.tar.gz.sig
gpg: Good signature from
  "wolpass releases <releases@wolpass.[DOMAIN]>"

DISCLOSURE POLICY

Found a problem? Tell us first.

1Write to security@wolpass.[DOMAIN]. Seal it to our key if you can.
2A person answers within [DAYS] working days, and says what we will do and by when.
3We fix it, and tell you before the fix ships. For anything that could open an entry: within [DAYS] days.
4It goes in the changelog with a security tag, with your name if you want it there.

Safe harbour

Act in good faith, stay inside this policy, and stop when you reach someone else's data. We will not take legal action against you, or ask anyone else to.

Not in scope

Overloading our servers. Tricking our staff. Taking someone's key and PIN.

SECURITY.TXT/.well-known/security.txt

Contact: mailto:security@wolpass.[DOMAIN]
Expires: [DATE]
Encryption: https://wolpass.[DOMAIN]/security/key.asc
Policy: https://wolpass.[DOMAIN]/security#report
Acknowledgments: https://wolpass.[DOMAIN]/security/thanks
Preferred-Languages: en
Canonical: https://wolpass.[DOMAIN]/.well-known/security.txt

Signed with the security key below, so you can tell it is ours.

BUG BOUNTY

We pay for what breaks a promise on this page.

The first person to report a problem gets paid, once we confirm it. Where it lands in the range depends on how much it takes to use it.

IF YOU CAN	WE PAY
Open an entry without a key it is sealed to	€[AMOUNT] – €[AMOUNT]
Get a PIN, or an open entry, off a device you do not control	€[AMOUNT] – €[AMOUNT]
Read or change another account's data, even sealed	€[AMOUNT] – €[AMOUNT]
Make the extension or autofill fill on the wrong site	€[AMOUNT] – €[AMOUNT]
Anything else that weakens what we promise here	up to €[AMOUNT]

CONTACT

security@wolpass.[DOMAIN]

Key [FINGERPRINT] · answered within [DAYS] working days

Write to us