// SECURITY PRACTICES

How PassFX protects your credentials

## Encryption

Algorithm:Fernet (AES-128-CBC + HMAC-SHA256)
Key Derivation:PBKDF2-HMAC-SHA256
Iterations:480,000
Salt:Cryptographically random (per vault)

## Zero-Knowledge Architecture

PassFX implements a true zero-knowledge design:

  • Your master password never leaves your machine in any form
  • Encryption keys are derived locally using PBKDF2 with high iteration count
  • No server-side components exist to compromise
  • No network connections are ever made by the application
  • Even if an attacker obtains your vault file, they cannot decrypt it without your master password

## Air-Gap Compatible

PassFX is designed for air-gapped environments:

$ netstat -an | grep passfx

(no results - zero network activity)

  • Zero DNS lookups
  • Zero HTTP/HTTPS requests
  • Zero telemetry or analytics
  • Zero update checks
  • Works completely offline after installation

## Vault Storage

Your encrypted vault is stored locally:

$ ls -la ~/.passfx/vault.enc

-rw------- 1 user user 2048 Dec 21 10:00 vault.enc

  • File permissions: 600 (owner read/write only)
  • Location: User home directory (~/.passfx/)
  • Format: Encrypted binary blob
  • Backup: Manual only (you control your data)

## Threat Model

PassFX protects against:

  • Remote attackers: No network surface to attack
  • Cloud breaches: No cloud storage to breach
  • Vault theft: Encrypted with strong key derivation
  • Brute force: 480,000 PBKDF2 iterations make attacks impractical

PassFX does not protect against:

  • Compromised local machine (keyloggers, malware)
  • Physical access to unlocked session
  • Weak master passwords (use a strong passphrase)
  • Social engineering attacks

## Vulnerability Reporting

Found a security issue? We take security seriously.

Please report security vulnerabilities responsibly:

  1. Do not open a public GitHub issue for security vulnerabilities
  2. Review our SECURITY.md for reporting instructions
  3. Allow reasonable time for a fix before public disclosure

## Verify Yourself

PassFX is 100% open source. Audit the code yourself: github.com/dinesh-git17/passfx

Security through obscurity is not security. Every cryptographic decision in PassFX is documented and open to scrutiny.