End-to-End Encryption
Military-grade AES-256 encryption protects your data. Everything is encrypted on your device before it reaches our servers.
Guide
Explore Other Features
Overview
What end-to-end encryption means for your data
End-to-end encryption ensures that your data is encrypted on your device before it ever leaves your browser. This means that even we cannot read your data. Only you, with your master password, can decrypt and access your information.
Hexbon uses industry-standard AES-256 encryption, the same encryption standard used by governments and financial institutions worldwide to protect classified and sensitive information.
AES-256 Standard
Military-grade encryption with 256-bit keys, virtually impossible to break.
Client-Side Processing
All encryption happens in your browser. Your keys never leave your device.
Zero-Knowledge
We cannot see your data. Even if compelled, there is nothing to hand over.
PBKDF2 Key Derivation
Your master password is securely derived into encryption keys with 600,000 iterations.
How It Works
The encryption process step by step
Master Key Generation
When you set up your vault, a unique encryption key is derived from your master password using PBKDF2 with 600,000 iterations. This key is generated entirely in your browser and never transmitted.
Local Encryption
Every piece of data you save is encrypted in your browser using AES-256-GCM encryption. A unique initialization vector (IV) is generated for each encryption operation to ensure security.
Secure Transmission
The encrypted data is sent to our servers over TLS-encrypted connections. We only ever receive and store encrypted blobs that are meaningless without your master key.
Local Decryption
When you access your data, the encrypted blobs are downloaded and decrypted in your browser using your master key. Only you can read your information.
Security Features
Multiple layers of protection for your data
No Server-Side Keys
Your encryption keys are never sent to or stored on our servers. They exist only in your browser during active sessions.
Unique IV Per Operation
A cryptographically secure random initialization vector is generated for every encryption operation, preventing pattern analysis.
Authenticated Encryption
AES-GCM provides both encryption and authentication, ensuring data integrity and detecting any tampering attempts.
Secure Key Derivation
PBKDF2 with 600,000 iterations makes brute-force attacks computationally infeasible, even with weak passwords.
Technical Details
For developers and security-conscious users
| Algorithm | AES-256-GCM |
| Key Length | 256 bits |
| IV Length | 96 bits (12 bytes) |
| Key Derivation | PBKDF2-SHA256 |
| Iterations | 600,000 |
| Salt Length | 128 bits (16 bytes) |
| Auth Tag | 128 bits |
| Implementation | Web Crypto API (native browser) |
For complete technical documentation, see our Encryption Documentation.
Ready to Get Started?
Start using Hexbon today and experience true zero-knowledge encryption.
Get Started Free