8PWDEncryption & export compliance
The same list the app shows under Me › Notices & Terms › Encryption & export compliance. Published here so it can be checked without installing anything. It applies equally to the iPhone, iPad and Mac versions, which share one code base.
Algorithms in use
AES-256-GCM
Every secret value: passwords, two-factor secrets, notes, password history and the contents of the trash. Also used to wrap the data key, to encrypt backup files, and to encrypt the small snapshot the 2FA widget reads.
PBKDF2-HMAC-SHA256
Turns your master password, once you set one, into a key-encrypting key, at 600,000 iterations. The same function with the same cost protects encrypted backup files under their backup password.
HKDF-SHA256
Turns the entropy behind your 12-word recovery phrase into another key-encrypting key, so the phrase can unwrap the same data key your master password does.
SHA-256
The BIP-39 checksum on the recovery phrase, and fingerprints used to recognise a backup you have already imported.
HMAC-SHA1 / SHA-256 / SHA-512
Time-based one-time passwords (RFC 6238). SHA-1 is the default because that is what almost every site issues; the others are there for the ones that don't.
How the keys fit together
One random 256-bit data key encrypts the vault. It is generated on your device and never leaves it.
On a fresh install that key is stored in the device's Keychain, available to the app while the device is unlocked — or, if you turn biometric unlock on, only after Face ID or Touch ID. It exists on that device and nowhere else — a new device starts from your backup file.
When you turn on anti-theft encryption and set a master password, the key is additionally wrapped twice — once by a key derived from the password, and once by a key derived from your 12-word recovery phrase. Either one then opens the vault on any device; neither is derivable from the other. Changing the master password re-wraps the first copy and leaves the phrase untouched. Vaults created before version 1.0 have carried these two wraps from the start.
We hold neither. There is no master key, no escrow and no backdoor. This is a structural property of the design, not a policy we could quietly change: there is no network path by which your key could reach us even if we wanted it.
Structural information — account names, field labels, folder names — is stored in the clear so that search and the list work before anything is unlocked. Values are encrypted. We would rather say that plainly than let you assume otherwise.
No network path
The app contains no networking code of its own: no HTTP client, no sockets, no third-party SDK that might carry one. The only network activity is the optional 8PWD 2026 Pro purchase, performed by Apple's StoreKit framework in Apple's own process — the app receives an entitlement, never a payment record. Nothing about your vault is uploaded, because there is nothing to upload it with. You can confirm this from outside the app with Airplane Mode and with Settings › Privacy & Security › App Privacy Report, which lists every domain an app has contacted.
What never leaves your device
- Your master password and your recovery phrase, once set — neither is stored anywhere, even locally, in a form that could be read back.
- The data key, which lives in the system Keychain of the device (behind Face ID or Touch ID if you turn that on), and — once a master password is set — in the vault, wrapped.
- Every secret value in the vault.
- The security score, which is computed on device and shown only to you.
Export control
8PWD uses encryption and is therefore subject to the US Export Administration Regulations. It is classified as ECCN 5D992.c — mass-market encryption software under Note 3 to Category 5, Part 2 of the Commerce Control List.
The app implements no proprietary or non-standard cryptography. It uses the algorithms listed above, as provided by Apple's CryptoKit and CommonCrypto, for the sole purpose of protecting the user's own data on the user's own device.
MNV LIMITED keeps an internal classification record for this determination, retained so it can be produced to the Bureau of Industry and Security on request.
This page matches the app as of 2026-09-15.