Answers about VaultHarbor security, installation, sync, and your data.
VaultHarbor is a zero-knowledge password manager. Your credentials are encrypted on your device before they are synced. The server stores only opaque encrypted blobs; it never sees your master password or plaintext vault contents.
No. Your master password and decrypted vault never leave your device. The server stores only encrypted data it cannot read. VaultHarbor is designed so that even the operator cannot access your secrets without your master password.
Your account password signs you in to VaultHarbor and enables sync across devices. It is stored on the server as a secure hash. Your master password encrypts and decrypts your vault locally and is never sent to the server.
If you set up a recovery key during vault creation, you can use it to regain access and set a new master password. Without your master password or recovery key, your encrypted vault cannot be decrypted. This is by design for zero-knowledge security.
Use the password reset flow in the extension. You will receive a code by email. Resetting your account password changes API login only; your vault remains decryptable with your master password or recovery key.
The VaultHarbor extension works on Chromium browsers: Google Chrome, Microsoft Edge, and Brave. Firefox support is experimental and not yet verified for production use.
Download the latest zip from GitHub Releases, unzip it, open chrome://extensions (or edge://extensions), enable Developer mode, and click Load unpacked. See the install section for full steps.
Installs from the Chrome Web Store or Microsoft Edge Add-ons will auto-update once store listings are live. Manual installs from a GitHub zip do not auto-update, so you must download and reload a newer version yourself.
Yes. The source code is available on GitHub. You can review the encryption design and self-host the backend.
Yes. The backend is a Flask API that can be deployed to your own infrastructure. Point the extension at your server URL during configuration. Your encrypted vault data stays under your control.
We store your email, account password hash, encrypted vault blob, device name/type for sync, and sync metadata (timestamps, revision numbers). We do not collect master passwords, recovery keys, or plaintext credentials. See our Privacy Policy for details.
You can wipe your vault from within the extension. To fully remove your account, contact manojhankare2@gmail.com. Encrypted vault data and account records will be deleted from our servers.
The marketing website at vaultharbor.manojhankare.in does not use analytics cookies or third-party trackers. The extension uses local storage on your device for session tokens and vault cache, not advertising cookies.