Velto Guard

VeltoGuard — Zero-Knowledge Password Manager & Secure Vault Your passwords, encrypted before they ever leave your device. The server sees nothing. VeltoGuard is a zero-knowledge, client-side-encrypted password manager and secure vault. Every piece of data you store — passwords, secure notes, payment cards, and documents — is encrypted in your browser using AES-256-GCM before it is ever sent to the server. Your master password never touches our servers. Your encryption key never leaves your device. How It Works When you create an account, VeltoGuard derives two separate cryptographic keys from your master password entirely in your browser using PBKDF2 (600,000 iterations of SHA-256): An authentication key — transformed into a hash that is sent to the server for login verification. The server stores only a bcrypt hash of this value. An encryption key — used to encrypt and decrypt all your vault data. This key is never transmitted, never stored on the server, and never leaves your browser. This means even if our servers were completely compromised, an attacker would find only bcrypt hashes and AES-256-GCM ciphertext — computationally infeasible to reverse without your master password. Chrome Extension Features Autofill — Fast, Automatic, Smart The VeltoGuard extension automatically detects login forms as you browse the web and fills your saved username and password with a single click. No more copying and pasting. No more typing credentials by hand. Detects username and password fields on login pages Matches saved credentials by website URL Fills fields instantly from the extension popup Prompts you to save new credentials when you log in to a site not yet in your vault Payment Card Autofill VeltoGuard goes beyond passwords. Save your payment cards securely in the vault and let the extension fill card details on checkout pages automatically. Supports standard payment forms as well as advanced embedded payment iframes (including Adyen Secured Fields used by major e-commerce platforms). Card number, expiry, CVV, and cardholder name all fill correctly — even on split-field forms. Mini-Vault Popup Access your entire vault directly from the extension popup without opening the full web app. Browse, search, copy, and autofill from anywhere in your browser. Session Sync — No Second Login Log in once on the VeltoGuard web app and the extension is automatically authenticated. No separate login, no token entry. Your session is shared securely using a trusted browser messaging channel. The extension will never ask you to log in again if you are already logged in on the web. Trusted Device Support Mark your browser as trusted and skip re-entering your master password every time the vault locks. Your encryption key is wrapped with a random device secret stored in your browser — you unlock instantly without sacrificing security. Vault — Store Everything Securely Passwords Store login credentials with username, password, URL, and notes. All fields are encrypted. Secure Notes Keep private information — WiFi passwords, PINs, software licences, recovery codes — in fully encrypted text notes. Only you can read them. Payment Cards Store card details (cardholder name, card number, expiry, CVV, notes) securely encrypted. Use them with autofill on checkout pages. Documents (Premium) Upload and encrypt files directly in your vault. PDFs, images, identity documents — stored as AES-256-GCM encrypted blobs. Up to 1 GiB of document storage included with Premium. Organisation Folders Create folders to organise your vault. Nest folders inside folders for as many levels as you need. Folder names are encrypted — even the names of your categories stay private. Favorites Star frequently used items to keep them at hand. Search Full-text search across your entire vault. Find any item instantly. Category Filtering Filter your vault by item type: passwords, notes, cards, documents. Security Architecture AES-256-GCM Encryption Every vault item is encrypted with AES-256-GCM using a random 12-byte initialisation vector per item. This is the same encryption standard used by banks and governments worldwide. PBKDF2 — 600,000 Iterations Key derivation uses 600,000 PBKDF2-SHA-256 iterations. This makes brute-force attacks against your master password computationally expensive even if an attacker has the ciphertext. bcrypt Authentication Your login credentials are verified using bcrypt with a cost factor of 12 on the server side. The raw authentication key never enters our systems. Two-Factor Authentication (2FA) Add a second layer of protection with TOTP two-factor authentication. Compatible with Google Authenticator, Authy, Microsoft Authenticator, and any RFC 6238-compatible app. Scan a QR code, confirm with a 6-digit code, and your account is protected. 10 one-time backup codes are generated during 2FA setup so you can regain access if you lose your authenticator device. Account Recovery If you forget your master password, your vault is not lost. VeltoGuard generates a recovery phrase during registration. Your encryption key is wrapped with a key derived from this phrase and stored on the server as ciphertext — the server never knows the phrase or the key. Enter your recovery phrase and your vault is fully restored, then re-encrypted with your new master password. Trusted Devices Trust a browser to skip master password re-entry on subsequent unlocks. A random 32-byte device secret wraps your encryption key locally. If you remove the trust, the wrapped key is deleted. Auto-Lock The vault automatically locks after 15 minutes of inactivity on untrusted devices. Your vault key is cleared from memory and cannot be accessed without re-authentication. Real-Time Sync Vault changes sync in real time across all your open tabs, devices, and the extension via a WebSocket connection. Open the web app and the extension side by side — they stay perfectly in sync. Password Tools Password Generator Generate strong, rand…