Security

Security that starts with “local”

Bevel Keys encrypts your password vault on your Mac. Unlock happens locally with your master password, or Touch ID after you enable it. Bevel Keys does not require a cloud account to open your vault.

What we encrypt

Vault contents are stored encrypted at rest on disk. Backups remain encrypted. Optional Premium iCloud Sync (off by default, user-initiated) copies that same sealed vault package into your iCloud Drive — encryption happens on the Mac before anything is copied.

What we don't do

We don't ask you to create a Bevel Keys web account to use your vault. We don't run a Bevel Keys cloud that holds passwords. Optional Premium iCloud Sync (off by default) copies ciphertext you already encrypted into your iCloud Drive — only if you turn it on. Unlock stays on the Mac.

Recovery

If you forget your master password, your recovery phrase is the path back in. If you lose both, Bevel Keys cannot invent a backdoor.

A 12-word recovery phrase is issued when you create your vault, and again if you change your master password. Store it offline.

Practical habits

  • Use a strong, unique master password
  • Store the recovery phrase offline
  • Keep encrypted backups
  • Lock the app when you step away

Updated August 2026