Yes. All your password data is encrypted using AES-256-GCM — the same encryption standard used by governments and banks. The encryption key is derived from your master password using PBKDF2 with a unique random salt. Your master password never leaves your browser, and without it, the encrypted data is unreadable. However, local storage is accessible to JavaScript running on the same origin, so always ensure you're using a trusted device.

Unfortunately, there is no way to recover your data if you forget your master password. The encryption is designed so that only your master password can decrypt the vault. This is why we strongly recommend backing up your vault regularly (using the "Backup" button) and storing the backup file in a safe place — but remember, you'll still need your master password to decrypt the backup. Consider using a password hint or storing your master password in a secure secondary location.

Browser password managers are convenient but often tied to a specific browser or account. This Local Password Vault gives you full control: your data stays entirely on your device, encrypted with a key only you know. It works offline, doesn't sync to any cloud server, and you can export/import backups easily. It's ideal for storing passwords you don't want synced across devices or stored on third-party servers.

AES-256-GCM (Advanced Encryption Standard with 256-bit key in Galois/Counter Mode) is a highly secure encryption algorithm. It provides both confidentiality (your data is secret) and integrity/authentication (any tampering with the encrypted data is detected). The 256-bit key makes brute-force attacks computationally infeasible with current technology. GCM mode also ensures that if someone modifies the encrypted data, the decryption will fail, protecting you from tampering.

A strong master password should be: at least 12 characters long, include a mix of uppercase letters, lowercase letters, numbers, and symbols. Avoid common words, names, or patterns. Consider using a passphrase — a sequence of random words (e.g., "correct-horse-battery-staple") — which is both strong and easier to remember. The password strength indicator will guide you as you type.

Since all data is stored in your browser's local storage, it's tied to one browser on one device. To use it on another device, use the "Backup" feature to export an encrypted JSON file, transfer it to the other device, and use "Restore" to import it. You'll need the same master password on the new device to unlock it.

Auto-lock automatically locks your vault after a period of inactivity (no mouse movement or keyboard input detected). This protects your passwords if you step away from your computer. You can adjust the auto-lock timer or disable it entirely. When locked, the decrypted data is wiped from memory, and you'll need your master password to unlock again.