Has KeyNesta had an independent security audit?
Security · Help center · Current as of 2026-10-10
Short answer
No. No independent security audit has been completed, and KeyNesta is not open source. The cryptographic primitives come from audited open-source libraries (noble-ciphers and noble-hashes), but that is not the same as anyone having reviewed this application, and it would be dishonest to present it as such.
What is actually true today
- The primitives are audited. AES-256-GCM and scrypt come from noble-ciphers and noble-hashes, which are widely used and independently reviewed.
- The application is not. No external firm has reviewed how KeyNesta uses them: key handling, the sync protocol, the client implementation.
- The source is not public. So you cannot check it yourself either.
What you can inspect anyway
The encryption architecture documents the scrypt parameters, the wrapped-master-key design, the per-object authenticated data, exactly what the sync server stores, and the threat model including what it does not defend against. Browser developer tools will show you that the site makes no third-party requests and sets no cookies.
Why say this at all
Every competitor worth comparing against leans on an audit, open source, or both. Claiming either without having it is the one thing that would make the rest of the security page worthless. When an audit happens it will be published here with the report, not summarised.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms