How end-to-end encryption protects your client logins
A plain-English guide to how ClientKeeps encrypts every client login in your browser, and why even we can't read them.
Most password managers say they are "end-to-end encrypted". This page explains, without jargon, what that means for your clients' logins in ClientKeeps. For the full technical details, see our security page.
The short version
Your logins are locked on your own computer before they are sent to us. The key that unlocks them comes from your master password, and that never leaves your browser. We only ever store the locked version. Nobody but your team can read your logins, not even us.
What end-to-end encryption means
Think of a safe-deposit box where you lock the box yourself before handing it to the bank. The bank stores and moves the box, but it never has the key. ClientKeeps works the same way:
- You type a login into ClientKeeps.
- Your browser encrypts it on your device.
- Only the encrypted version travels to our servers and is stored there.
- When a teammate opens it, their browser decrypts it with a key only your team holds.
Because the "ends" are your team's browsers, the login is never readable anywhere in between: not in transit, not on our servers, not in our backups.
Keys only your team holds
Each client has its own key, and each login can have its own key too. A team member can open a client's logins only if that client's key has been shared with them. When someone leaves, their access ends and you get a list of every login they could open, so you know exactly which passwords to change.
Why a breach of our servers wouldn't expose your passwords
An attacker who broke into our servers would find encrypted data and no keys to open it. Your master password is never sent to us, and it goes through Argon2id, a deliberately slow process that makes guessing it very expensive.
A second step when you sign in
Signing in on a new computer, or a sign-in that looks unusual, needs a second step: a code we email you, a code from an authenticator app, or a passkey. Admins can require the app or a passkey for everyone in the workspace.
Every action is recorded
Opening, copying and changing a login is written to a tamper-evident audit log. Each entry is chained to the one before, so a deleted or edited entry would show.
Sharing with clients, safely
When you ask a client for their logins with a secure link, what they type is encrypted in their browser for your team only. It never sits in an email inbox.
What we can still see
End-to-end encryption protects the secrets, not everything. To make lists and search work, our servers can see your client and website names and the names of logins, plus who opened which login and when. They can't see usernames, passwords, URLs, 2FA keys, notes or files.
Want to go deeper? Read what "zero-knowledge" really means, or create your free workspace.