How It Works

All sensitive data in the Passwordstate database such as passwords, documents and authentication options, are encrypted within the database using AES 256 or FIPS encryption. In order to decrypt this data in the user interface to make it readable to an authorized user, Passwordstate uses two encryption keys.

One half of these encryption keys resides in the database, and the other half in the web.config file. When you log into Passwordstate, these keys are joined and then used to decrypt sensitive data, which makes it readable to you in the user interface.

When encrypting a web.config file using Microsoft commands, the encryption is formed using some unique system keys already built into your Windows operating server. This provides an additional layer of protection, as they can only be decrypted on the same server they were initially encrypted on.

As you cannot decrypt these files on different servers, it’s critical that you ensure you export your encryption keys, and store them securely outside your Passwordstate server – without these encryption keys, and if you have a server crash which is not recoverable, then it would not be possible to recover your Passwordstate instance.

For this reason, it is critical to keep a secure backup of your Passwordstate encryption keys.