Docs / Obsidian Vault / Reference

How your vault is protected

A password manager holds the keys to everything else, so Obsidian Vault is built so that nobody but you can open your vault, including us. This is called zero-knowledge encryption.

Your master password never leaves your device

When you type your master password, your device stretches it with Argon2id (64 MiB of memory, 3 passes by default), a slow calculation that makes guessing very expensive. From the result it makes two separate keys:

a sign-in key, which proves to us that you know the password. Only this is sent, and we store only a further one-way hash of it, so even our database holds nothing a device would accept.
an unlock key, which never leaves your device. It unlocks your vault key, and your vault key unlocks your items.

So we can check who you are without ever being able to unlock your vault.

Everything is encrypted before it is sent

What	How
Each item	Encrypted with AES-256-GCM under a random key of its own. Moving or sharing one item never exposes another.
Item keys	Locked with your vault key (your own items) or the organization's key (organization items).
Attachments	Encrypted in your browser or app before upload, with a key of their own.
Folder, collection and group names	Encrypted too.
Sharing, organizations, emergency access	P-256 public-key encryption: an item or vault key is locked to the other person's public key, so only they can unlock it.
Where things sit	Each encrypted value is bound to its place, so nobody could swap two items' passwords on the server without your device noticing.

Before you share an item, confirm an organization member or an emergency contact, you compare a fingerprint phrase of five words with the other person, by phone or in person. If the words match, you are encrypting to their real key and not to an impostor's.

What we can and cannot see

We cannot see the contents of any item: names, usernames, passwords, websites, notes, cards, addresses, custom fields, verification-code secrets, passkeys or attached files, nor the names of your folders, collections and groups.

We can see what we need to run your account: your email address and name, your devices and when and from which network address they sign in, security events, the size and dates of your encrypted items, who you share with and which organizations you belong to, and your plan. The privacy policy lists it all.

Breach checks without your password

The security dashboard checks your passwords against known breaches by sending only the first 5 characters of a one-way hash of each password, through our service to Have I Been Pwned. Your device does the matching. Your password, and even its full hash, never leave the device.

Protecting your account

Two-step login: authenticator app, security keys and passkeys, email codes, and a recovery code. See Two-step login and devices.
New devices can be asked for an emailed code, and we email you about every new sign-in.
Sign-in tokens are kept only as hashes, expire, and change on every use; a token used twice signs that device out and alerts you.
Guessing is limited: repeated failed sign-ins from one address or against one account are paused.

On your devices

Your vault key is kept in memory only while the vault is unlocked, and wiped when it locks.
The encrypted copy of your vault on a device can only be opened with your master password, or with a quick-unlock key protected by the device (Windows Hello, the phone's secure hardware, or a PIN).
The browser extension fills a login only into a page whose address matches it, never shows vault contents to the page, and copies to the clipboard only what you ask for, clearing it again afterwards.

What you can do

Choose a long master password you use nowhere else, such as four or five random words.
Turn on two-step login, and keep your recovery code somewhere safe.
Name an emergency contact, so a forgotten master password isn't the end of your vault.
Work through the security dashboard now and then.