Titan Password Vault

Your master password never leaves your device

When you set your master password, it is not sent to the server — not in plain text, not hashed, not in any form. Instead, your device uses it as raw material for the next step. The server never receives it and therefore cannot store, leak, or be compelled to reveal it.

A vault key is derived from your master password — on your device

Your device runs your master password through a slow, computationally expensive one-way key derivation function (Argon2id or PBKDF2 with a high iteration count). This produces a cryptographic key — your vault key. The algorithm is deliberately slow so that even if an attacker obtained encrypted data, guessing your password by brute force would take an impractical amount of time. The vault key is held in memory only while the app is unlocked and is never written to disk.

All vault data is encrypted locally with AES-256 before leaving your device

Every item in your vault — passwords, notes, card numbers — is encrypted using AES-256-CBC with your vault key before it is transmitted to the server. The server receives and stores only ciphertext: a block of random-looking bytes that is mathematically unreadable without the vault key that produced it.

The server stores only encrypted blobs — it has no decryption key

SoftSol’s Titan server manages the sync infrastructure: it receives encrypted vault data, stores it, and delivers it to your authorised devices. It has no vault key and no knowledge of your master password. An attacker who gains full access to the server obtains only encrypted ciphertext — which is useless without the key that exists only in your memory and on your unlocked device.

Decryption happens on your device, not on the server

When you unlock your vault, your device downloads the encrypted blob and uses your locally-derived vault key to decrypt it entirely in the client app. Your plaintext passwords are only ever visible on your device, inside the app, while it is unlocked. This is what end-to-end, zero-knowledge encryption means in practice.

Your master password cannot be recovered — by anyone

Because SoftSol never holds your master password or vault key, we cannot reset it or recover it for you. If you forget your master password, your vault data is irretrievably locked. This is a deliberate design choice, not a limitation — it is the same property that makes Titan trustworthy. Treat your master password with the same seriousness as the key to a physical safe. We strongly recommend storing it in a secure, offline location (a printed emergency kit in a fireproof safe, for example).