The password vault is the security core. Unlike legacy cloud managers that hold ciphertext on multi-tenant servers, Lokker guarantees: Your device is the sole data authority. No plaintext ever leaves your browser memory.
Client Cryptographic Flow
Client Hardware Isolation
1. User Master Secret
▼Master Password or Hardware Passkey
2. Key Derivation
▼PBKDF2-SHA256 (100k) or PRF Output
3. 256-bit VEK
Unwraps AES-GCM Vault Payload
Verified Cryptographic Primitives
Every sensitive object utilizes standard AES-GCM 256-bit with cryptographically random 12-byte IVs generated via crypto.getRandomValues().
Zero Telemetry & Zero Escrow
There are no analytics SDKs, error trackers, or telemetry beacons. Your master password cannot be recovered by any third party; only your physical Emergency Recovery Key or biometric hardware slot can restore access.