Question 1

Where exactly is my encrypted vault stored on my computer?

Accepted Answer

Your vault is stored locally in your browser's sandboxed LocalStorage under the key 'kitwharf_vault_v1' (on Windows: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Storage\leveldb\; on macOS: ~/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/; on Linux: ~/.config/google-chrome/Default/Local Storage/leveldb/). You can also export a standalone encrypted .kwvault file which saves directly to your device's Downloads directory for cold storage.

Question 2

What happens if I clear my browser cookies, cache, or site data?

Accepted Answer

If you clear 'Cookies and other site data', your web browser will delete its LocalStorage database and remove the working encrypted container. We strongly recommend downloading a .kwvault backup file whenever you add or modify passwords, so you can restore your vault in one click.

Question 3

Is this password vault truly zero-knowledge and offline?

Accepted Answer

Yes. All encryption and decryption operations execute 100% locally in your web browser's RAM using the native Web Crypto API (AES-GCM-256 and PBKDF2 with 600,000 iterations). Your master passphrase and decrypted credentials never leave your device and are never transmitted to any cloud server.

Question 4

Can KitWharf, your hosting provider, or any third party access my passwords?

Accepted Answer

No. KitWharf operates with a strict zero-cloud architecture. There are no remote user accounts, no backend databases, and no server-side decryption keys. All decryption occurs exclusively in your computer's browser memory.

Question 5

Why does KitWharf use PBKDF2 with 600,000 iterations?

Accepted Answer

600,000 iterations of SHA-256 is the recommended OWASP and NIST 2026 security standard for PBKDF2. This computational difficulty makes brute-force dictionary attacks against your master passphrase computationally infeasible, even when using specialized cracking hardware.

Question 6

What is a .kwvault file and how do I transfer it?

Accepted Answer

A .kwvault file is an encrypted JSON backup file containing your AES-GCM ciphertext, unique salt, and initialization vector. You can transfer this file to any computer or mobile phone via USB drive, AirDrop, or secure file sharing, and open it with your master passphrase.

Question 7

What happens if I forget my master passphrase?

Accepted Answer

Because KitWharf operates with strict zero-knowledge architecture and does not maintain any backdoors or user accounts on remote servers, your master passphrase cannot be reset or recovered by anyone. Make sure to download an encrypted .kwvault backup file and keep your master passphrase safe.

Question 8

Does KitWharf clear copied passwords from the clipboard?

Accepted Answer

Yes. When you copy a password, KitWharf triggers a 30-second security timer and automatically wipes the clipboard once the countdown expires, preventing clipboard scraping malware from capturing credentials.

Question 9

How does the inactivity auto-lock feature work?

Accepted Answer

KitWharf continuously monitors user activity (mouse movement, key presses, touch input). If no activity is detected for your chosen duration (1m, 5m, 15m, 30m, 1h), the application wipes the decrypted secrets from browser RAM and locks the vault.

Question 10

Can I use this password vault completely offline without internet?

Accepted Answer

Yes. Once the web application is loaded in your browser, all cryptographic functions, password generators, search indexing, and file exports run 100% locally on your computer with zero internet connectivity required.

Create Zero-Knowledge Vault

In-Depth Guides & Tutorials

Zero-Knowledge Offline Password Vault: How In-Browser AES-GCM-256 Protects Your Credentials Without the Cloud

What Actually Makes a Password Strong? Entropy, Length, and Common Myths

SHA-256, SHA-512, and UUIDs Explained: How Cryptographic Hashes and Identifiers Work

Complementary Tools

Zero-Knowledge File Encryptor & Decryptor (AES-256-GCM)

SHA Hash Generator & UUID Creator

Password Generator

JWT Encoder, Decoder & Debugger

Client-Side Privacy Guarantee