01Encrypted on your device
Primitive Pass encrypts your vault on your device before it is uploaded. Our server stores encrypted vault data and does not have the vault keys needed to read a locked vault.
02Signing in without sending your password
Sign-in uses OPAQUE, so your master password is not sent to or learned by the server.
Vault decryption occurs on an authorised client after the user unlocks the vault.
03What our server can and can't see
Primitive Pass is designed around the following boundary: our server stores encrypted vault data and does not have the vault keys needed to read a locked vault.
The service may store and synchronise encrypted records including:
- encrypted key bundles;
- encrypted vault and item records;
- encrypted secure notes, login records and API-secret records;
- encrypted sharing records where sharing is enabled; and
- sync revisions and record identifiers required to synchronise devices.
The service is designed so this server-side vault material is ciphertext rather than readable vault content.
04The browser extension
The Primitive Pass Chrome extension has one purpose: to let you use credentials and passkeys from your Primitive Pass vault on websites you choose, while keeping vault contents encrypted.
- The extension asks for access to a website only when you enable that site. On an enabled site it may process the page address and login or passkey fields needed to save, match or fill a credential. Primitive Pass does not collect an ordinary browsing-history feed or arbitrary page content for advertising or analytics.
- When you choose to copy a vault secret, the extension places that value on the local clipboard. It checks whether the copied value is still present before clearing it, so it does not intentionally overwrite something you copied afterwards.
- Optional native messaging connects only to the Primitive Pass companion on the same computer, and only after you enable that feature and grant the browser permission.
05If you forget your master password
Primitive AI cannot simply reset a forgotten master password and decrypt the vault on the user's behalf. Where recovery is available, it relies on the user's Recovery Key and re-wrapping of the user's key material.
Keep your Recovery Key somewhere safe and offline.
06Security in practice
Primitive Pass uses technical and organisational controls intended to reduce unauthorised access, disclosure, alteration and loss.
The product architecture includes client-side encryption, authenticated encryption, a separate account-authentication protocol, scoped network egress, session controls, rate limiting and fail-closed validation of untrusted server records.
No internet-connected service can promise absolute security.
Primitive AI maintains a cyber security incident and data breach response process. If an incident affects personal information, Primitive AI will assess the incident and take notification or remediation steps required by applicable law and the circumstances.
Security questions or requests: hello@primitiveai.com.au