What the KeyNesta server stores
Read from the sync server's source code. Current as of 2026-10-10.
Short answer
Without a sync account, nothing: the app works entirely on your device and uploads nothing. With sync on, the server holds an account record, your device list, your vault as encrypted objects it has no key for, and your wrapped key. It never holds your passphrase, your secrets or the names of your services.
Without sync
Nothing is sent to the server. No account is needed to generate codes, and KeyNesta never asks for a phone number. Everything in the table below exists only if you create a sync account.
With sync: every record, field by field
This is the whole list of what the sync database keeps for an account. Each row names the fields the server code actually stores.
| Record | What is stored | Can we read it? |
|---|---|---|
| Account | Random account ID, email address, bcrypt hash of the account password (empty if you only ever signed in with Google or Apple), the provider's account identifier if you used one, created date, an email-verified flag. | Yes: it is the account. The password itself is never stored. |
| Device | Device ID, the name and platform you gave it, created date, last-seen time, revoked flag. | Yes. This is what Settings, Sync shows you and lets you revoke. |
| Vault object (one per space, group and code, plus one for settings) | Random object ID, type label, version, nonce, ciphertext, deleted flag, server timestamp of the last change. | No. Everything meaningful is inside the ciphertext. |
| Key slot | Your vault key wrapped under a key derived from your passphrase with scrypt, plus the salt, scrypt parameters and nonce. | No. It cannot be opened without your passphrase. |
| Password-reset token | A SHA-256 hash of the emailed token, the account ID and an expiry time. Single use, and deleted automatically after expiry. | Only the hash exists, so the token cannot be rebuilt from it. |
| Plan | Account ID, plan (free or Pro), where Pro came from, status, start and end dates, and which of our staff granted or revoked it. | Yes. It is what Settings, Plan shows you. |
| Pro Early Access request | Account ID, status, request and decision dates, the optional note you wrote, and the reason if it was declined. | Yes, including your note: it is written for us to read. |
| Audit record | What happened (a request, an approval, a staff action on the account), when, and the account ID. No email address and no IP address. Kept after the account is deleted. | Yes. It is our record of who did what. |
What we cannot see
- Your vault passphrase and the unwrapped vault key. Both exist only on your devices.
- Your 2FA secrets and the codes they generate.
- The name, issuer, account, tags, spaces and groups of any entry, and your profile name. They are inside the encrypted objects.
Each object is encrypted on your device with AES-256-GCM before it is uploaded, and the type and version are bound into the encryption, so a server cannot swap an old object in as a newer one. The encryption architecture has the parameters.
What we can see
The shape of your vault, not its content: how many objects of each type exist, how large they are, and when each last changed. Like any web server, it also sees the IP address and time of each request while you sync. Those access logs are deleted after at most 15 days and are not used for visit statistics; the privacy policy has the details.
What this page does not cover
This page is about the sync database. How long server logs are kept, who hosts the servers, and how your email address may be used are set out in the privacy policy, which is the authority on those. The shorter help article gives the same picture in a few lines.
What we do not claim
KeyNesta is not open source, so you cannot read this code yourself, and it has not had an independent security audit. This page describes the server as written in our own repository. The security overview lists the other known limits.
Frequently asked questions
Can the KeyNesta server see the names of the services in my vault?
No. The name, issuer, account, tags and secret of every code are inside the encrypted object, which the server stores as ciphertext. What it can see is the object type label ("entry", "group", "space" or "settings"), a random object ID, a version number, the ciphertext size and when the object last changed.
Does the KeyNesta server know how many codes I have?
Probably, yes. Each space, group and code is uploaded as its own encrypted object with a type label, so the server can count the objects of each type and see their sizes and change times. It cannot see what any of them contain.
Is my KeyNesta account password the same as my vault passphrase?
No, and they never meet. The account password authenticates you to the sync server, which keeps only a bcrypt hash of it. The vault passphrase stays on your device and is used to unwrap the vault key. Resetting the account password does not touch the vault, and cannot open it.
Is anything left on the KeyNesta server after I delete my sync account?
The deletion code removes the account record, every device record, every encrypted object, the key slot, the plan and any Pro Early Access request. Audit records stay, holding only the internal account ID. Password-reset tokens are single-use, hashed, and expire by themselves. The vault on your own devices is untouched.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms