Architecture at a glance
- Vault data is encrypted on the device before it is stored in local IndexedDB.
- The current design derives an AES-256-GCM key from the master password using PBKDF2-HMAC-SHA-256 with 310,000 iterations and a per-vault random salt.
- TOTP codes are generated locally. The TOTP setup secret may be stored in the same vault as its login.
- Trove does not provide an account service or automatic cloud synchronization. Encrypted backups are created and moved by the user.
These details describe the current implementation, not a certification that it is secure for every use. The application is free to use, but its source code is not currently published under an open-source license. No independent third-party security audit has been completed.
Threat-model limits
Trove is designed to protect stored vault contents when the vault is locked, assuming the master password is strong and the device, operating system, browser or app runtime, and application build are trustworthy.
Trove cannot protect against malware, a compromised or unlocked device, keylogging, memory inspection, malicious browser extensions, coercion, or an attacker who obtains a weak-password vault and performs offline guesses. Decrypted data exists in memory while the vault is unlocked. A checksum can detect a changed download, but a checksum served from this same website does not independently prove who published the file.
Android biometric unlock is a convenience feature and does not replace the master password. The Windows installer currently has no digital publisher signature. Keep encrypted backups and protect them separately.
Using TOTP in the same vault
Keeping a password and its TOTP setup secret in one vault is convenient, but it means both factors rely on the security of that vault. If you want an independently protected second factor, keep the authenticator secret in a separate app or device.
Downloads and verification
Download only from the official Trove downloads page. Compare the downloaded file with its published SHA-256 value. The installer is currently unsigned, and the public GitHub releases and Google Play listing are not available. Do not interpret a matching checksum as proof of publisher identity.
Report a vulnerability privately
Email manish.cs1@gmail.com with a brief description, affected platform and version, impact, and steps to reproduce. Please do not include passwords, vault files, personal records, or other secrets. Email may not be end-to-end encrypted; do not send sensitive proof or attachments unless a safer transfer method has been agreed.
Please give the maintainer a reasonable opportunity to investigate and address a report before publicly disclosing it. No response-time commitment or coordinated-disclosure program is currently published. For general product issues, use the support form instead.
Product scope
Trove is an offline personal vault, not a full browser password-manager replacement. It does not currently provide browser autofill, browser extensions, passkeys, automatic sync, or import from other password managers. See the features page for the current scope.