“Encrypted on this device” means your vault is encrypted with AES-256-GCM before it is saved, so the readable vault never sits in plain localStorage. A PIN-derived key unlocks it in the browser.
Every vault, free or paid, is saved to your account in that encrypted form so it can sync. Be realistic about a 4-digit PIN: we store a check value made from your username and PIN to sign you in, and someone with our database could guess a PIN that short.
Export a backup before you change devices. Import restores the encrypted package; you unlock with the same PIN you used when you exported.
If you forget the PIN, we do not reset it. That is the tradeoff of a vault that cannot be reset by a support inbox.
Google convenience mode is a different contract: we store a vault key and release it only to your authenticated Google session on this site. Neither mode is zero-knowledge. Privacy and Security use that wording on purpose.
The 2FA codes and quick notes tabs are different again: they are saved only on this device, without encryption, and are not part of the vault or its backup.
This is not a SOC 2, ISO, or insurance page. Those claims are not published here. If that changes, link a real report — not a placeholder badge.
Questions people ask
- Can LoginScout reset a forgotten PIN?
- No. There is no PIN-reset email. Export a backup while you still remember the PIN.
- Is Google sign-in zero-knowledge?
- No. Google convenience mode stores a vault key for that Google session. PIN vaults are not zero-knowledge either, because a 4-digit PIN is short. Security and Privacy have the exact wording.
- Do you publish SOC 2 or ISO badges?
- Not on this site. Do not invent certifications. If an audit report is published later, the security page should link the real document.
Ready to try it?
Create a free vault and keep logins, mail, and MFA together.
Related: Security · Privacy · How it works