Client-Side Cryptographic Vault

Your Passwords, Readable Only by You

Encrypted directly on your device before sync. Securely access, autofill, and manage your vault across your phone, laptop, and PC, all with zero-knowledge cryptographic separation.

Create Account Sign In

Phone (iOS & Android)

Laptop (Browser Extension)

Desktop PC (Web & Extension)

Instant multi-device sync · 600,000 PBKDF2 rounds · Zero analytics or tracking

Architectural Evaluation

How tark-pass Compares to Commercial Vaults

An objective architectural comparison of key isolation, client-side cryptography, and privacy boundaries. Evaluated as of November 2026.

Technical evaluation of security boundaries and access models as of November 2026.
Security & Architecture	tark-pass	1Password	Bitwarden	Browser Vaults
Cryptographic Key Separation	Yes: Dual HMAC Keys	Yes: Secret Key + Master	Yes: Split Derived Hash	No: Single Account Key
Cryptographic Engine	Yes: W3C Web Crypto (Native)	Proprietary: Proprietary Native	Yes: Web Crypto / JS libs	No: OS Keystore Dependent
PBKDF2 Work Factor	Yes: 600,000 Rounds	Yes: 650,000 Rounds	Yes: 600,000 Rounds	No: Undisclosed / OS Level
Autofill Conflict Suppression	Yes: Active Extension API	No: No Suppression	No: No Suppression	No: Self-Preferenced
In-Page Quick Unlock	Yes: Shadow DOM Modal	No: App Window Focus	No: Toolbar Popup Only	No: OS Biometric Prompt
Feature Access Model	Yes: All Features Included	No: Paid Subscription	Tier-Gated: Tier-Gated Limits	No: Ecosystem Lock-in
Third-Party Telemetry	Yes: Zero (Strict CSP)	No: Cloud Analytics	No: Operational Metrics	No: Ad & Profile Sync

Cryptographic Architecture

Strict Client-Side Key Separation

Every secret is processed locally inside your browser runtime. The server stores only authenticated binary ciphertexts and bcrypt verification hashes.

600,000-Round PBKDF2 Key Stretching

Master password and user cryptographic salt are processed client-side via PBKDF2-HMAC-SHA-256 to derive a 256-bit MasterKey.

PBKDF2-HMAC-SHA-256 · 600,000 iterations

Dual-Key Cryptographic Separation

HMAC-SHA-256 splits the MasterKey into two distinct cryptographic entities: an AuthKey for server identity authentication, and a VaultKey for symmetric encryption.

AuthKey (Hashed) · VaultKey (Browser-Only)

AES-256-GCM Authenticated Encryption

Every individual vault item is encrypted with a unique 96-bit initialization vector and a 128-bit authentication tag before any network transmission occurs.

AES-GCM-256 · 96-bit unique IV · 128-bit auth tag

Inactivity Auto-Lock & Memory Hygiene

The auto-lock timer monitors user activity. Upon lock or session timeout, decrypted keys are cleared from active runtime variables on a best-effort basis (subject to browser garbage collection cycles).

Configurable 1-60 min auto-lock timeout

Server Storage Reality

ZERO-PLAINTEXT

Even with root administrative access to the SQLite database, an operator or attacker only sees opaque AES-GCM binary blobs without semantic structure.

sqlite > SELECT ciphertext FROM vault;

{
  "iv": "dK9q1z...88m",
  "ciphertext": "a9xT02...kL1",
  "tag": "c044a8...91b"
}

Security Boundaries

Our Threat Model & Web Vault Realities

Cryptographic honesty matters. In any web-delivered password manager, the client trusts the hosting server to deliver untampered JavaScript. Here is exactly how we approach this boundary.

The Web Vault Boundary

When accessing tark-pass via a web browser, your device fetches the client application over TLS. A compromised server could theoretically alter delivered JavaScript. If your threat model precludes trusting web delivery, use the standalone browser extension verified against public checksums.

Strict Content Security Policy

We enforce default-src 'self', script-src 'self', and frame-ancestors 'none'. No inline scripts are permitted, and the application cannot connect to third-party endpoints or CDNs. All cryptographic operations use native browser crypto.subtle with zero npm packages.

Server Breach Resilience

If our database were compromised, the adversary would acquire only random salts, bcrypt AuthKey verification hashes, and AES-256-GCM ciphertexts. Without your locally remembered Master Password, the stored data is mathematically indecipherable.

Multi-Device Deployment

Installation & Device Setup Guides

Seamlessly access and synchronize your vault across your phone, laptop, and PC. Install tark-pass on desktop browsers, your iOS home screen, and Android devices with native zero-knowledge security.

Download Browser Extension (v1.0.5)

Pre-packaged Manifest V3 extension featuring hardware-accelerated Web Crypto, isolated Shadow DOM quick unlock, and active autofill collision suppression.

Download Extension (.zip) Firefox Package (.xpi)

SHA-256 (.zip): 4f8b3fa7258be4fddaec92f789754401a23b11ec743646b43154c9af6a36dd1b

Download the Extension Package

For Chrome, Brave, or Edge, download tark-pass-extension.zip and extract the archive. For Firefox, download tark-pass.xpi.

Open Extensions Manager

In Chrome, Brave, or Edge, navigate to chrome://extensions. In Firefox, navigate to about:addons, click the gear icon, and select “Install Add-on From File...” (or drag and drop the .xpi file into Firefox).

Load Extension into Browser

In Chromium browsers, enable Developer mode in the top-right corner and click Load unpacked to select the extracted folder. In Firefox, confirm the installation prompt to activate the add-on.

Pin to Toolbar & Sign In

Pin the tark-pass shield icon to your toolbar and click it to unlock your vault with zero-knowledge separation.

Desktop Architecture Chrome / Brave / Edge

iOS Safari Home Screen Web App

Runs as a standalone full-screen Progressive Web App on iPhone and iPad. Utilizes local Web Crypto storage and memory session isolation.

Open Safari & Enter URL

Launch Safari on your iPhone or iPad and navigate to https://tarkpass.william-skipper.site.

Tap the Share Button

Tap the Share icon located in the center of the Safari bottom toolbar (represented by a square with an arrow pointing upward).

Tap “Add to Home Screen”

Scroll through the iOS Share Sheet and select Add to Home Screen (marked with a plus inside a square icon).

Confirm & Launch Standalone App

Tap Add at the top right. A dedicated tark-pass app icon will appear on your iOS home screen, launching in distraction-free full-screen mode.

iOS Safari Workflow iPhone & iPad

Android Progressive Web App (PWA)

Installs directly into the Android system launcher and app drawer. Runs with native hardware Web Crypto acceleration and standalone windowing.

Open Browser & Navigate

Launch Google Chrome, Brave, or Firefox on Android and navigate to https://tarkpass.william-skipper.site.

Tap the Browser Menu

Tap the three-dot overflow menu icon (⋮) in the top-right corner of your browser toolbar.

Select “Install app”

Tap Install app (or Add to Home screen in Firefox) from the menu options.

Confirm & Launch

Tap Install on the system prompt. tark-pass installs to your home screen and launcher as a standalone client.

Android PWA Workflow Chrome & Firefox

Unified Multi-Device Access

One Vault Across Phone, Laptop & PC

Your encrypted vault stays synchronized in real-time across your phone, laptop, and PC. Every credential you add on one device is instantly available everywhere.

Phone (iOS & Android)

Mobile Web App / PWA

Touch-optimized, full-screen mobile app for iPhone and Android. Quick unlock, search, and biometric persistence right from your mobile home screen.

View Mobile Install Steps

PC & Laptop Extension

PC & Laptop Browser Extension

In-page field detection with isolated Shadow DOM quick-unlock for Chrome, Brave, Firefox, and Edge. Suppresses native browser autofill collisions and auto-suggests matching credentials.

View Installation & Download

Universal Web Client

Zero-Install Web Vault

Zero-dependency client with instant search, category filtering, cryptographic password generation, and universal CSV/JSON/HTML export on any desktop computer.

Accountability & Governance

Who Operates tark-pass & How It Is Sustained

Transparency about our operational foundation, funding model, and long-term continuity guarantee.

Operator & Governance

tark-pass is developed and operated independently by William Skipper. It is maintained as a focused, lightweight zero-knowledge utility rather than an ad-funded venture. For inquiries or security disclosures, contact contact@william-skipper.site.

Subscription Sustainability

tark-pass is funded directly through user subscriptions rather than venture capital, investor pressure, or advertising. A transparent subscription model ensures direct alignment with user privacy, continuous maintenance, and reliable infrastructure.

90-Day Continuity Guarantee

You are never locked in. You can export your complete vault in standard, unencrypted CSV or JSON at any moment. If tark-pass is ever scheduled to retire, a public announcement will be issued with a minimum of 90 days advance notice to ensure complete data portability.

Technical Clarifications

Frequently Asked Questions

Concrete answers regarding cryptographic boundaries, account recovery, licensing, and operational practices.

What happens if I forget my Master Password?

Because of our zero-knowledge architecture, your Master Password is never transmitted or stored on our servers. We do not maintain any recovery backdoors or reset keys. If you lose your Master Password, your encrypted vault records are permanently unrecoverable. We strongly advise maintaining regular offline backups (via our built-in CSV/JSON export tools) stored in a secure physical location.

What is your threat model regarding web-delivered JavaScript?

In any web-delivered application, the user trusts the server not to serve modified code. We mitigate this through strict Content Security Policy rules (default-src 'self', script-src 'self') that disallow inline scripts and prohibit external network egress. For zero-trust environments, we provide pre-packaged desktop extensions verifiable against published SHA-256 checksums that do not depend on per-session code delivery.

Is tark-pass open source or a proprietary service?

tark-pass is a proprietary, subscription-backed zero-knowledge service. While the backend source code is not publicly shared or self-hosted, all client-side cryptographic routines execute openly inside your browser and can be fully audited via browser Developer Tools. Extension packages are distributed as unminified, inspectable zip archives.

What would an attacker obtain if the server database were breached?

An adversary with full root database access would obtain only user account usernames, random salts, bcrypt hashes of the client-derived AuthKey, and opaque AES-256-GCM ciphertexts. Because the VaultKey never leaves browser memory and is derived with 600,000 PBKDF2 rounds, the stored records cannot be decrypted without your local Master Password.

Does tark-pass support credential sharing between accounts?

Not currently. tark-pass is engineered strictly around individual single-tenant zero-knowledge vaults where records are encrypted exclusively with your personal Master Key. Because the server possesses zero access to your decrypted keys or data, cross-account sharing is omitted to prevent any cryptographic compromise of your private vault perimeter.

Can I access and sync my vault across my phone, laptop, and PC?

Yes. tark-pass is built for seamless multi-device synchronization. You can install the browser extension on your laptop and desktop PC, add the standalone PWA to your iPhone or Android phone home screen, and sign in to the web vault on any computer. Every record is encrypted on your local device with your VaultKey before syncing, so updates are instantly reflected across all your devices without the server ever having plaintext access to your credentials.

How do I migrate my existing passwords from other managers?

tark-pass features built-in CSV and JSON import tools that automatically recognize field headers exported from 1Password, Bitwarden, LastPass, KeePass, and Chrome/Firefox password managers.

Take Control of Your Digital Secrets

Client-side Web Crypto encryption, zero telemetry, and complete data portability.

Create Account Sign In