Protection for stored secrets
MYKEYNEST encrypts stored passwords with AES-256-GCM before persistence. Encrypted values include a random initialization vector and an authentication tag used to detect tampering.
Important: encryption at rest complements authentication, authorization and device security; it does not replace them.
How does it work?
- Your account is authenticated and permissions are checked.
- An account-specific encryption key is derived together with the application secret.
- The server returns a decrypted secret only through an authorized flow: viewing, permitted sharing or extension autofill.
What this implies
Protect account access with a unique password, 2FA when available and regular session reviews. If you forget the password, use Forgot password on the sign-in page.
Never share a reset link or validation code with a third party.