The password vault even Klavox can't read
End-to-end, zero-knowledge encryption: your passwords are encrypted on your device before they ever leave the screen. European and sovereign, on web, Android and iOS.
A portable, auditable crypto core — proven primitives only, never home-made crypto.
Zero-knowledge, in the strictest sense
No secret in plaintext — master password, vaultKey or vault items — ever reaches the server, logs, telemetry or a URL. Compromising the server yields nothing but ciphertext.
-
Proven primitives onlylibsodium / WebCrypto / Argon2id — never home-made crypto.
-
Unique random nonceOne nonce per encryption, AEAD across the board (integrity + confidentiality).
-
Shared, portable crypto coreA single TypeScript codebase with no network dependency, reused identically on web, Android and iOS.
-
Ciphertext-only syncRevisions, timestamps and tombstones for multi-device sync — never any readable content.
A complete vault, built to last
The crypto core and vault model are already in development; everything else follows the public roadmap.
Password generator
Generated locally with strong entropy; tune length, symbols and ambiguous characters.
Built-in TOTP
Two-factor codes generated inside the vault, encrypted like any other item.
Multi-device sync
Revisions plus conflict resolution (last write wins, per field), with end-to-end encryption.
Web, Android, iOS
PWA vault plus native apps, keystore/secure enclave, biometrics and autofill.
Encrypted import / export
Import from Bitwarden, 1Password or CSV — encrypted export so you stay in control at all times.
Recovery key
An optional backup key generated at sign-up — your only safety net if you lose your master password.
Kopilvia intelligence — AI-first, sovereign
Security recommendations (weak, reused or breached passwords) computed by Kopilvia, the sovereign AI SDK of the SANTVIA galaxy — on the roadmap, hosted in the EU, never run on your plaintext secrets.
Klavox vs. Bitwarden, 1Password and Proton Pass
Zero-knowledge isn't unique to Klavox: the difference lies in legal sovereignty, an open crypto core and a local vault that is genuinely free.
| Criterion | Klavox | Bitwarden | 1Password | Proton Pass |
|---|---|---|---|---|
| Zero-knowledge | Yes | Yes | Yes | Yes |
| Vendor & hosting | SANTVIA — France / EU | Bitwarden Inc. — United States (self-hosting possible in the EU) | 1Password — Canada | Proton — Switzerland |
| Open crypto core | Yes, portable TS | Yes | No | Yes (client apps) |
| Free local vault, no account | Yes | No (account required) | No (paid trial) | No (account required) |
| Audience | Consumers + professionals, SANTVIA galaxy | Consumers + business | Consumers + business | Consumers |
Comparison based on each vendor's publicly available information as of this page's publication date. Klavox is in development (crypto core delivered) — see the roadmap.
Free locally, sync pricing coming soon
No prices are set yet for sync and teams: they will be published at launch, in line with the SANTVIA galaxy plans.
- Encrypted vault, single device
- Password generator
- Built-in TOTP
- No account required
- Ciphertext-only sync across all devices
- Android + iOS apps, autofill
- Recovery key
- Secure item sharing
- Admin console & directory
- Enforceable WebAuthn / 2FA
Klavox works hand in hand with the rest of the galaxy
Every SANTVIA product works on its own; together, they form a coherent sovereign suite.
Frequently asked questions
Can the Klavox server see my passwords?
No. Klavox encrypts every item on the client before anything is sent. The server only stores and syncs encrypted data: your master password, your vaultKey and your passwords are never sent to it in plaintext.
What encryption does Klavox use?
Argon2id to derive the master password, HKDF-SHA256 for key stretching, and AEAD (XChaCha20-Poly1305 or AES-256-GCM) with a unique random nonce for every item. Proven primitives only.
Is Klavox free?
The local vault, without sync, is free. Multi-device sync and team sharing plans are in the works; their pricing will be published at launch.
Is Klavox available on mobile?
Android and iOS (keystore/secure enclave, biometrics, native autofill) arrive after the crypto core and the web vault, according to the public roadmap.
What happens if I forget my master password?
Without it, and without a recovery key, your vault stays undecryptable: that's the price of true zero-knowledge. Klavox technically cannot reset it for you.
Where is my data hosted?
On sovereign European infrastructure operated by SANTVIA. The server stores nothing but ciphertext and sync metadata.
Does Klavox use artificial intelligence?
Klavox is designed AI-first through Kopilvia, the sovereign AI SDK of the SANTVIA galaxy, hosted in Europe: non-sensitive signals only (strength, reuse, known breaches), never any access to your plaintext secrets. On the public roadmap.
Be the first to know when Klavox launches
The zero-knowledge crypto core is already being developed in the open. Join the waitlist to follow our progress.
Three steps, all on the client
The Klavox server never performs any cryptography: it only receives and syncs data that is already encrypted. All key derivation and encryption happen on your device.
Argon2id derivation
Your master password and your email (as salt) run through
Argon2id(≥ 64 MB memory, ≥ 3 iterations) to produce a 256-bitmasterKey. It never leaves your device.Protected vault key
A random
vaultKeyis generated, then encrypted with the stretchedmasterKey(HKDF-SHA256). Changing your master password re-encrypts only this key, not your whole vault.Per-item encryption
Every login is encrypted individually with AEAD (
XChaCha20-Poly1305/AES-256-GCM) and a unique random nonce. The server only ever syncs this ciphertext.