Security model

The short version: your password never leaves your device, and everything sensitive is encrypted before it is sent. This page is the long version, including the parts that are inconvenient.

How your key is protected

When you register, a keypair is generated on your machine. Your password is put through Argon2id — a deliberately slow function — to derive a key, and that key encrypts your private key. Only the encrypted form is uploaded. Logging in reverses this locally: the server hands back the sealed key material and your password unseals it on your device.

This is why nobody here can reset your password. There is no copy of it to check against, and no copy of your private key we could open.

How sharing works without sharing a password

Each project has its own key. When a project is granted to someone, that project key is sealed to their public key, so their copy opens only with their private key. Values inside the project are encrypted with the project key.

What the server can see

• That a secret exists, its key name, and which project and environment it is in
• Who changed or read something, and when
• Your account details and which devices you use
• Never: a secret value, your password, or any private key in usable form

What is stored on your machine

Being honest about the local side matters as much as the server side.

• ~/.bippass/config.yaml holds your server, email and active context. No password, no keys.
• Your token and unlocked private key go to your operating system keyring. On a machine with no keyring available, they fall back to a file readable only by you — worth knowing on headless servers.
• If you use sync, a copy of your secrets is kept locally in plaintext under ~/.bippass/base as the merge baseline. It is never uploaded, and it is readable by anything running as you.
• pull writes a plaintext .env file, because that is what a .env file is. Prefer run, which keeps values in memory.

Keeping secrets out of git

The CLI can scan for exposed secrets and install a pre-commit hook that blocks a commit containing them.