Security Coming soon
The server neither receives nor stores the keys
Passwords are encrypted and decrypted on your device. The server receives encrypted text that cannot be read without the keys, including entry names, addresses, usernames and notes. Here you will find how it works, what you need to get in and what the server knows anyway.
Two things open the vault, and you remember only one
The master password is the only one you need to remember, and there is no hint. Alongside it is your account’s secret key, which Kamzan Pass keeps in the browsers where you use it. Together they open the vault. The practical downside: if you clear browser data or change computer, the secret key is lost there, and to get back in you need another active device, the recovery code or company recovery.
How it works
-
You create the master password
First you read what happens at your company if you lose it. Then you choose it: until it is strong enough, Kamzan Pass does not continue and tells you what is missing.
-
You keep the recovery code
It appears once and cannot be seen again. Keep it like a key, not next to the computer: together with your Kamzan ID login, it opens your account.
-
You unlock when needed
The vault opens with the master password and closes itself after a period of inactivity, and in any case after a maximum time. Your company can shorten these times.
One promise only: the server neither receives nor stores the keys
What you can do
-
What does not go to the server
Master password, keys, recovery code and entry text, including names, addresses, usernames and notes. The project’s automated tests stop any column that would carry them in plain text.
-
What the server knows
Who uses Kamzan Pass and since when, which vaults exist, who belongs to them, how many entries they hold, when they change, and when and from where people connect. Not for which sites.
-
Approving a second device
The new browser shows some words, you type them on the device that is already active and retype the master password. Approve only a request you have just made yourself.
-
If you lose a device
“Regenerate the secret key” removes every device except the one in front of you. If it was stolen that is not enough: with “My master password is compromised” you replace all the account’s keys.
-
Offline, read-only
If the server does not respond, Kamzan Pass opens the encrypted copy on the device: you read and copy, you do not edit. The copy has a maximum age, beyond which it asks you to reconnect.
-
Web vault and extension are not the same
Our server loads the web vault at every opening, as with any manager that has a web app. The browser extension is the most protected way to use Kamzan Pass.
Frequently asked questions
Can the server read my passwords?
The server stores encrypted data and does not have the keys to open it. The limit must be stated: that server delivers the web vault, and anyone controlling it could deliver a modified version. That is why the extension is the most protected way to use Kamzan Pass. All the limits are on the “What Kamzan Pass does not protect” page.
What if I forget the master password?
There are two ways: your recovery code, or company recovery if it has been enabled. In that case the company can recover the account; it stays on record, and the person is notified if they can still log in, the other administrators always. Without either, the data cannot be recovered.
What happens if I change computer?
The new browser does not have your account’s secret key. The recommended way is approval from a device that is already active; otherwise the recovery code. That is why two devices are worthwhile: with only one, clearing browser data means losing the key.
Has the design been reviewed by outside experts?
Not yet: the Kamzan Pass design has not been reviewed by an outside cryptographer. Until it is, no sentence on this site should be read as a guarantee verified by third parties.
The other Kamzan Pass features
Want to see it before it arrives?
We show you Kamzan Pass on a test vault: how a password is shared, what happens when someone leaves the company and what the server doesn’t see. Half an hour, no strings attached.
Alex