Why Aranor keeps your vault on your phone

Most password managers sync your vault through their servers. It’s encrypted before it leaves your device, and for most people that’s a reasonable design. But it means a copy of every customer’s vault sits in one place, and that place is worth attacking.

A copy on a server can be guessed at forever

Encryption protects a vault only as well as the master password behind it. If attackers copy encrypted vaults from a server, they don’t need to break the encryption. They can take as long as they like guessing master passwords offline, and every weak one they find opens a vault. Nothing alerts the owner, and changing the master password afterwards doesn’t help, because the stolen copy was locked with the old one.

Aranor removes that target. Your vault is stored on your phone, and Aranor’s servers never receive it, not even encrypted. There’s no pile of vaults for anyone to copy, including us.

Even the list of sites stays private

Which sites you have accounts at says a lot about you: your bank, your doctor, your workplace. So Aranor treats that list as a secret too. It doesn’t fetch website icons, and it avoids any feature that would put a saved site’s address on the network.

How it’s locked on the phone

Your master password is turned into a key with Argon2id, which makes every guess cost time and memory. That key opens an encrypted database, and each entry inside it is encrypted again with AES-GCM. If you use fingerprint or face unlock, the key is sealed by the phone’s own secure hardware. The security page has the details.

What you give up, and how Aranor covers it

Keeping the vault on one device has real trade-offs, and we’d rather be clear about them.

• Moving to a new phone. Hold the two phones together and transfer by QR code, with nothing on the network, or move an encrypted file.
• Losing your phone. Keep a backup: an encrypted file you store where you like, or, with Premium, an encrypted backup in your own Google Drive.
• Forgetting your master password. There’s no reset, because a reset would be a way in for someone else too. When you create your vault, Aranor gives you a recovery code. Keep it somewhere safe and offline.
• Other devices. Aranor is an Android app. It fills logins in apps and in browsers on that phone.

If you want a password manager whose servers hold nothing worth stealing, that’s what Aranor is built to be.