Encrypted on your device
Every field is encrypted before it leaves your device, including website addresses, item names and folders. Each item has its own key.Every field, including website addresses and folder names, with a key per item.
SECURITY
Your vault is yours alone
Your passwords are encrypted on your device before they go anywhere. Here’s how that works, what we can and can’t see, and how to tell us if you find a problem.Your passwords are encrypted on your device before they go anywhere. Here’s how it works.
Passkey first
Unlock with a passkey and Face ID or your fingerprint. A Recovery Code you keep gets you back in. A master password is optional, and comes with a Secret Key.Unlock with a passkey. A Recovery Code you keep gets you back in.
Nothing to crack on our side
We never receive your passkey secret, Recovery Code or master password. Password sign-in uses OPAQUE, so a breach of our servers gives away nothing to guess against.We never receive your unlock secrets, so a breach gives away nothing to guess against.
Every request signed by your device
Each device has its own key and signs every request. There are no session tokens to steal, and you can sign out a lost device from any other.No session tokens to steal. Sign out a lost device from any other.
Autofill that checks the site
Logins fill only on the exact site you saved them for. On a lookalike address, AdPass warns you before you type anything.Logins fill only on the exact site you saved. Lookalikes get a warning.
Blocking that stays on your device
Ads and trackers are blocked inside your browser, so we never see the sites you visit. Filter updates are data, never code.We never see the sites you visit. Filter updates are data, never code.
ZERO KNOWLEDGE
What we can and can’t see
We keep only what we need to sync your devices and run your account. Everything else stays scrambled.
WE CAN SEE
- Your email address
- Your devices and when they last synced
- How much encrypted data you store
- Your plan and billing status
WE CAN NEVER SEE
- Your passwords, usernames and notes
- Website addresses, item names and folders
- Your passkey secret, Recovery Code or master password
- Which sites you visit or what gets blocked
HOW WE BUILD IT
Careful by default
- Encryption code lives in one shared core, written in Rust and built on widely used, audited libraries, with known-answer tests for every algorithm.
- Every change runs the full test suite, including end-to-end tests of autofill, sign-in and blocking, and tests that try to trick autofill the way attackers do.
- We check AdPass against OWASP ASVS Level 2, the industry checklist for apps that handle sensitive data, and track every gap until it’s fixed.
- Everything that reads data from outside, like import files, filter lists and passkey sign-ins, is tested with millions of broken inputs every week, and so is our sync server.
- Build tools are pinned to exact versions, dependency updates are reviewed, and OpenSSF Scorecard checks our supply chain on every change.
- This website loads nothing from other companies except a cookieless visit counter, and blocks inline scripts with a strict content security policy.
WHERE WE ARE
An outside review comes before paid plans
AdPass is in an invite-only beta. Our encryption design and threat model are written up in full. Before paid plans launch, an independent security expert will review them, and we’ll publish a summary of what they found and what we fixed.
Until then, the best check is you. If you find a problem, we want to hear about it.
Found a security issue?
Email [email protected]. We answer every report, keep you updated, and credit you when the fix ships. Research in good faith under our policy is welcome, and we won’t take legal action over it.
- WITHIN 3 BUSINESS DAYSWe confirm we got your report
- WITHIN 10 BUSINESS DAYSWe tell you whether we can reproduce it, and how serious we think it is
- WITHIN 30 DAYSWe fix critical issues (vault data, keys or sign-in at risk)
- WITHIN 90 DAYSWe fix other valid issues
HALL OF FAME
Thank you
People who reported a security issue to us and helped keep AdPass users safe. With their permission, we list them here once the fix ships.People who reported a security issue and helped keep AdPass users safe.
No reports yet. Yours could be the first name here.
How to report