Skip to content

Security

Sealed in your browser. Encrypted in transit and on our servers.

Encrypted in your browser AES-256-GCM Argon2id

Each item and each shared credential is encrypted in your browser before it is saved or sent. We keep the locked copy. We do not store the secret that opens it.

Create a free vault How it works

£0 · Free plan, no card needed · The same encryption on every plan

A person beside a protected web page

Principles

We store the vault, not the key

Three principles shape every part of Argoned, from your private vault to each credential you send to an AI agent or a person.
A person beside a locked safe

  • Locked first

    Passwords, keys and notes are encrypted in the browser before they are saved. What travels to Argoned is already locked.

  • The secret stays with you

    We do not store your vault secret. Without it, the stored vault is not something we can open for you, or for anyone else.

  • One item, one lock

    Each item has its own key. Opening one password does not open the rest of the vault.

Who can read what

  • Your passwords, keys and notes

    Readable only after you unlock the vault.

    Only you

  • The secret that opens the vault

    We don’t store it. Your browser sends it to us once, at setup, so we can email you a backup copy.

    Only you

  • Your email address

    We use it to sign you in and to contact you.

    You and Argoned

  • A credential you send sealed

    Only someone with both the link and the access code can open it, within the limits you set.

    Link and code holder

Sealed sharing

Sealed sharing and AI agents

Every sealed link is encrypted in your browser before it leaves, opens once with a separate access code and closes at expiry.
What happens to a credential you send as a sealed link
StageWhat happens
Where encryption happens In your browser. A new key is made from the access code with Argon2id, and the credential is sealed with AES-256-GCM.
What travels Encrypted data and a link. When you copy the code yourself, it is not sent to us.
What our server stores The encrypted data, its salt and settings, the expiry, how many times it may be and has been opened, when it was created and opened, which item and kind of field it came from, an optional label you type, and a hashed IP address from the most recent access.
Where it is opened Only where the access code is typed in.
Limits Opening attempts are rate-limited. Each link opens once and closes at expiry (at most 7 days).

AI agents: what is protected, and what is not

Protected

A sealed link keeps the credential encrypted at every step before it is opened.

  • While it travels: only encrypted data and a link leave your browser.
  • While it is stored: our server keeps the encrypted data, not the credential.
  • In the chat history: the chat holds only a link, never the password in plain text.

Not protected today

Once the credential is opened on a page an agent is reading, the agent can read it too. The agent, and the company that runs it, may keep what the agent saw. That is why we advise narrow logins and changing passwords after important tasks.

Encryption

Two standards, two different jobs

Argon2id turns a secret into a key, and AES-256-GCM locks the data with that key. Each one does a single job, in your browser.
A phone with a lock on the screen

  • Argon2id

    Argon2id turns your vault secret, or a sealed link’s access code, into a key. It is deliberately slow and uses a lot of memory, so guessing takes a long time, even on a powerful computer.

    Used for: your vault secret and access codes

  • AES-256-GCM

    AES-256-GCM locks each item and each sealed credential. GCM also checks that the locked data has not been changed. If it has been tampered with, it will not open.

    Used for: each item and sealed credential

The numbers

The numbers, for the technically curious

The exact settings the vault and sealed links use today, so you can compare them with your own security requirements.
Cryptographic settings used by the vault and by sealed links
SettingValue
Vault secret to unlock key Argon2id, time cost 2 to 6 (default 3), memory 64 to 256 MiB (default 128 MiB)
Sealed link access code to key Argon2id, time cost 3, memory 64 MiB
Item and key encryption AES-256-GCM with 256-bit keys
Keys per item A random data encryption key for each item, locked by the vault key
Where the work happens In your browser, using standard browser cryptography and Argon2id

Unlocking takes a short, deliberate moment so that guessing your secret stays expensive. That work happens when you open the vault, not on every click.

An optional recovery phrase can open the same vault. If you lose both your vault secret and your recovery material, the saved items stay locked.

Honest limits

Limits you should know about

Privacy has a cost you should know before you trust us with your vault, and some parts of Argoned are not finished yet.

What we have not done yet

  • No independent audit yet

    No independent security audit has been done so far. The code is public under the MIT licence, so anyone can read it. We will publish an audit summary here if and when one is done.

  • Agent Connector not built yet

    The Agent Connector, approval for each use and a history of uses are not built yet. They are in development, with no release date.

  • Two setup emails carry secrets

    When you finish setup, your browser sends your vault secret to our server so we can email you a backup copy. When you save recovery, the same happens with your recovery phrase. We do not store either one, but each passes through our server and our email provider and then sits in your inbox. Delete those emails once the secrets are stored safely.

Disclosure

Report a security issue

Found something that looks wrong? We welcome good-faith reports. Here is how to reach us and what to include so we can reproduce it.
A person sending a message

  • Email the security contact

    Write to team@argoned.com with “SECURITY” in the subject. We welcome good-faith reports.

    Email a security report →

  • What to include

    Describe what you found and how to reproduce it. Our Terms (section 7) ask that you get written permission before running active tests against the live service.

    Read the Terms of use →

  • Machine-readable contact

    Our security.txt file lists the same contact details in the standard format that security tools look for.

    Open our security.txt file →

  • Read the code

    The vault code is public under the MIT licence, so you can check how encryption and sealed sharing work before you report.

    Read the code on GitHub →

A person beside a locked laptop

Your agent needs a login. Send it sealed.

Create a free vault Read the FAQ

£0 · Free plan, no card needed · Encrypted in your browser