Argon2id
Unlock protectionDerives unlock keys from your master password locally. Parameters adapt to the device while keeping a security floor.
Seren/Passwords01Premise
Encrypted on your deviceUnreadable to the serverBy design
Store logins, 2FA secrets, notes, documents, API keys, infrastructure credentials, and attachments in vaults Seren cannot decrypt. Your master password and item keys stay on your device; Seren only handles encrypted blobs.
decrypt(item) — client-side
00
master_password[user-typed]
never leaves the browser
01
account_key[Argon2id]
kdf(master_password, salt)
02
identity_kem_private[X25519]
unwrap(account_key, sealed)
03
vault_key[X25519]
kem_unseal(identity_priv, wrapped_vault_key)
04
item_content_key[XChaCha20-Poly1305]
aead_decrypt(vault_key, wrap, aad)
05
item_body[XChaCha20-Poly1305]
aead_decrypt(content_key, body_ct, aad)
0 server-side decryptions performedOK
02How it works
Your device unlocks the vault, encrypts everything before it leaves, and keeps the keys local. Seren stores and syncs the resulting ciphertext across your devices without ever seeing what's inside.
Seren handles
- Encrypted recordsSeren stores ciphertext for vault items, attachments, and metadata so your devices can stay in sync.
- Access rulesMemberships, shares, and audit events let the service enforce who can reach which encrypted records.
- Sync stateVersion numbers and timestamps keep updates ordered without revealing the decrypted contents.
Your device handles
- Unlock materialYour master password, recovery key, vault keys, and item keys stay on your device.
- Vault contentsTitles, fields, notes, 2FA seeds, generated passwords, tags, and imports decrypt locally.
- Private metadataAttachment names, content types, sharing emails, and invitation emails are encrypted before upload.
Ownership
Your database. Your data.
Your encrypted vault lives in a SerenDB database listed in your Seren console. Inspect it, export it, point another tool at it, or delete the whole thing. Seren runs the infrastructure; the database and the data inside belong to you.
03How encryption works
XChaCha20-Poly1305
Vault encryptionEncrypts vault data before it syncs: fields, notes, tags, attachments, and email metadata. Each encrypted value is bound to where it belongs.
X25519
Secure sharingWraps vault and item keys for specific recipients, so sharing does not require handing a key to the server.
Ed25519
Signed actionsSigns sensitive actions such as resolving a secret, approving access, or granting membership. The server verifies before it acts.
HKDF
Key separationSeparates keys by purpose, so keys used for one protocol step cannot be reused in another.
SHA-256 / HMAC
Audit and lookupChains audit-log rows, hashes invite tokens, and turns email addresses into scoped lookup values without storing them in plain text.
Standard primitives, no custom ciphers. Every unlock and every decrypt happens in your browser through WebAssembly.
04Capabilities
Iscope: one item
Per-item content keys
Each item has its own content key. Sharing one login grants access to that login, not to every secret in the vault.
IIimports preserved
Structured records
Logins, notes, identities, cards, SSH keys, documents, bank accounts, passports, driver's licenses, crypto wallets, servers, databases, and API credentials each keep their natural shape.
IIIby email
Live shares by email
Share a single item by identity or email. Existing Seren users can claim after sign-in; new recipients prove the invited email before access is completed.
IVseren-secrets://
Agent secrets
Agents and command-line tools can resolve one credential field at a time through signed seren-secrets:// references, without opening the whole vault.
V100 MiB / item
Encrypted attachments
Attach files to any item. Filenames, content types, and file contents are encrypted before upload and tied to the item they belong to.
VIno escrow
Recovery without escrow
Setup gives you a recovery key. If you lose your master password, the recovery key reopens the vault. Lose both, and no one can open it — not even Seren.
05Sharing model
Three access paths, three scopes.
Vault invitations, item shares, and agent reads each use a different key and a different scope. Long-term access, one-off collaboration, and automated reads never share the same surface.
Vault invitation
Scope
Whole vault, persistent
Key
Vault key wrapped for member
Recipient
Long-term team member
Live share
Scope
One item, time-bounded
Key
Item key wrapped for recipient
Recipient
Contractor, one-off recipient
Agent resolver
Scope
One field per request
Key
Signed field request
Recipient
Agent or CI runner
06Start
Start with a vault Seren cannot read
Sign in with your Seren account. Setup creates a new encrypted vault and recovery key, and you can import from 1Password or Bitwarden in one upload.
Sign-in via console.serendb.com
Seren/Passwords