Client-side encryption
PBKDF2-SHA-256 protects a random vault key and AES-256-GCM encrypts each item before upload.
A private vault that KMAIL cannot read
A separate master password derives browser-only keys so the server stores ciphertext rather than your vault contents.
Useful item types
Store logins, secure notes, cards, identities, Wi-Fi credentials and software licences.
Local safety tools
Generate strong passwords and review weak or reused passwords without sending secrets away.
Strict recovery
KMAIL and administrators cannot recover a forgotten master password or inspect decrypted items.
Honest feature boundaries
Sharing and attachments remain disabled until complete reviewed end-to-end designs are available.