SpokPass

YOUR PASSWORDS ARE ENCRYPTED BEFORE THEY LEAVE YOUR PHONE. Every password manager says something like this. SpokPass lets you check it. Open the app, tap "See how it looks", and watch the line at the bottom of the login screen: that is literally what goes to our server. A block starting with "sp1." and nothing readable after it. No title, no site, no username, no password, no notes. WHAT THE SERVER ACTUALLY KNOWS When a record was last changed. Which folder it sits in. That is the complete list. WHY WE CAN'T READ YOUR VAULT The key is derived from your master password, on your device, and never leaves it. We don't hold a copy, a backup, or a recovery override. This isn't a policy we could quietly change in a future update — it's the shape of the product. BUILT THE SLOW WAY, ON PURPOSE • Argon2id with 64 MiB of memory. Deliberately expensive, so your master password can't be guessed millions of times per second on rented graphics cards. • AES-256-GCM. Change one bit of a stored block and it refuses to open, instead of quietly returning something wrong. • Search runs on your device, after decryption. A search index on our side would leak exactly what we promised never to see. FACE ID AND TOUCH ID The vault key goes into your phone's Secure Enclave and comes out only for your face or fingerprint. It never touches the network and is never written to ordinary storage. A GENERATOR THAT KNOWS ABOUT BAD FORMS Random passwords, created on your device. The symbol set leaves out quotes, apostrophes and backslashes — precisely the characters that sloppy sign-up forms strip in silence, leaving you with a saved password that no longer matches the site. IN YOUR LANGUAGE, NOT JUST IN ENGLISH Romanian, English, German, French, Italian, Russian, Arabic and Chinese — the whole app, not a machine-translated menu. Arabic reads right to left, the way it should. Switch language from the lock screen, before you even sign in. THE PART NOBODY ADVERTISES If you forget your master password and lose your recovery kit, your vault is gone. Permanently. There is no "forgot password, email me a link", because we have nothing to open it with. That is the exact same property that stops anyone else from opening it. We would rather you read this now than discover it later. YOUR DATA IS NOT OUR HOSTAGE Export everything, any time, in an open format — including after you stop paying. A password manager you cannot walk away from is a trap, not a product. For more information, visit spokpass.ro — the site is in the same eight languages as the app. SpokPass works with a SpokPass account. Accounts are created there too.