100% Client-Side Cryptography

Your Credentials.
Truly In Your Control.

ZoloPass is a lightweight, zero-knowledge, self-hosted password manager. It stores only raw, client-encrypted cryptographic blobs on your server. Even if your server is fully compromised, your passwords remain secure.

View GitHub Repo Try the Workflow Demo
Interactive Sandbox

Try the Decrypt & Copy-Paste Flow

Decrypt the ZoloPass vault loaded on the left, copy the credentials, and paste them into the mock browser portal on the right. Master Password: demo-vault-password

ZoloPass Client (Local App Sandbox)
https://yourfakeemail-portal.com/login

YourFakeEmail Portal

Enter credentials to access your secure account dashboard.

Sign-In Successful

Access granted to the YourFakeEmail Management Suite.

System Health 100% Secure
Client Host ZoloPass Demo
Features

Built for Ultimate Security and Control

Designed with zero dependencies, avoiding complex setup databases while retaining state-of-the-art encryption standards.

Zero-Trust Cryptography

Symmetric dual-layer AES-256-GCM client-side encryption. Master key derived via 600k PBKDF2-HMAC-SHA256 iterations. Your plain secrets never touch a server.

Self-Host Anywhere

Designed for PHP 7.4+ web servers, cPanel, or lightweight Docker containers. Uses file-based storage with robust multi-process file locking (flock) mechanisms.

Air-Gapped Decryption

Export a single-file offline HTML archive. It embeds your encrypted database and local JS code, letting you view and decrypt passwords with zero internet connection.

Rate Limits & Healing

Built-in IP-based login rate limiting, auto-healing database backups, direct-access blocking rules, and configurable inactivity auto-lock routines.

Architecture Diagram

Three Layers of Absolute Security

Explore the flow of data across the client and server during key phases of password vault management.

Master Key & Verification Hash Derivation

When you enter your Master Password, ZoloPass isolates authentication credentials from decryption keys, deriving two distinct items client-side:

  • Master Key: PBKDF2-HMAC-SHA256 (600,000 iterations). Stays in-memory, never sent to the server. Used to decrypt individual vault items.
  • Verification Hash: PBKDF2-HMAC-SHA256 (700,000 iterations). Sent to the server for session authentication and initial setup checks.
Master Password + Vault Salt
Split Key derivation
PBKDF2-SHA256 @ 600,000 ➔ Master Key (Decrypts Vault)
PBKDF2-SHA256 @ 700,000 ➔ Verification Hash (Auth Token)

Dual-Layer AES-256-GCM Encryption

ZoloPass avoids standard simple key setups. Every vault item is double-sealed, guaranteeing that master password changes don't require full database modifications:

  • Item Vault Key: A random 256-bit key is generated for every credential. The username, password, and notes are encrypted with this key using AES-GCM.
  • Master Key Seal: The Item Vault Key itself is then encrypted using the derived Master Key via AES-GCM. Changing your password only requires re-encrypting item keys.
Plaintext Credentials (username, password)
AES-GCM (Item Key)
Encrypted Data Blob
AES-GCM (Master Key)
Encrypted Vault Key (Stored inside metadata)

Zero-Trust Argon2id Server Verification

The server manages database read and write access without knowing your master password. Instead, authentication uses double-hashed protection:

  • Verification Hash Transmission: The client sends the derived verification hash over HTTPS.
  • Argon2id Hash Matching: The server runs native Argon2id password hashing to verify this token. The plaintext master password is never stored or transmitted.
Client transmits Verification Hash
HTTPS POST
Server API runs native password_verify()
Match Success
Server loads or saves encrypted JSON DB blob

Deploy Your Own ZoloPass Instance

Fully compatible with Docker and standard PHP web hosting accounts. Take control of your passwords in minutes.

Clone Repository Docker Setup Guide