End-to-end encryption means plaintext exists only at the ends you control. In a messaging app, that usually means sender and recipient devices. In a password manager, the meaningful “end” is your unlocked device after you authenticate with your master password. Everywhere else — in transit, at rest on our infrastructure, on a disk waiting for sync — the vault should remain ciphertext.
Vault App applies that rule to logins, secure notes, and credit cards alike. There is no plaintext mirror on the server “for convenience,” and no privileged role that can open a vault on demand. Encrypt locally, store encrypted, decrypt only after you unlock.
Where decryption is allowed to happen
The critical design question is not whether AES is used somewhere in the stack. It is where bytes become human-readable secrets. If decryption happens in a cloud worker so a web client can stay thin, the provider’s environment becomes an end — and so do the people who operate it. If decryption happens only after local key derivation on a device you unlock, the provider’s environment is a courier for sealed packages.
That is why “encrypted in transit and at rest” is not the same as end-to-end. TLS and disk encryption protect pipes and drives. They do not, by themselves, stop a service that holds keys from reading your data while fulfilling a request.
What this forces us not to build
Features that require the server to see your secrets — classic password sharing through our infrastructure, server-side password health that inspects plaintext, support tools that display an item — do not fit. We would rather leave a feature unshipped than break the end-to-end guarantee and keep the same homepage language.
Product constraints are security features. Every time a roadmap item assumes “we’ll just decrypt on the server for a second,” the architecture is asking you to trust us again. End-to-end encryption is the discipline of refusing that second.
What you should still do
Encryption does not make phishing impossible, and it does not replace a strong unique master password. It means a stolen database of vault blobs is a different class of incident than a stolen database of passwords. Combine end-to-end encryption with MFA, careful device hygiene, and unique generated passwords for each site.
When you evaluate a password manager, ask where decryption happens and who can force it. If the answer is “on our servers when needed,” it is not end-to-end in the sense that protects you when the operator — or someone pretending to be the operator — is not on your side.