How It Works
From organizing in a visual dashboard to encrypting and storing your data - see exactly how Hexbon works at every step.
What is Hexbon?
Hexbon is a simple, private way to store all your sensitive information in one place. Think of it as a vault where you control everything.
You structure your data however you need - passwords, notes, credentials, or anything else. We provide the secure storage. You keep the keys.
Encrypted on your browser
Data is locked with your master password before leaving your device.
We never have access
We store encrypted data. Without your password, it's meaningless to us.
Your data, your control
Create custom fields, organize as you like, and manage everything yourself.
Structure Your Data
Create records with custom fields for passwords, notes, credentials, or whatever you need to store securely.
Encrypt Locally
Your browser locks everything with your master password before it leaves your device - nothing unencrypted ever travels to our servers.
Store Safely
Your encrypted data lives in our database, protected by your password. Access it anytime from any device.
Easy To Organize
See how your data is displayed in the dashboard. Each field type has a dedicated visual representation for easy management.
Supported Field Types
Clickable hyperlinks that open in a new tab
User identifiers and login names, displayed as plain text
Email addresses, displayed as plain text with copy functionality
Sensitive data hidden by default, revealed on click with toggle visibility
Time-based one-time passwords with live countdown timer
General text information, displayed as plain text
Behind The Scenes
Your data is organized in a clean hierarchical format before encryption. This structure allows for flexible organization of sensitive information.
Structure Overview
Top-level containers for organizing related records into categories
Individual entries within a card, each representing a distinct item
Named groups of values within a record for logical organization
The actual content items with their display value and type
Each value has a type that determines how it is displayed:
Unix timestamp for tracking when the card was last updated
{
"cards": [
{
"title": "Accounts",
"records": [
{
"title": "Gmail",
"data": [
{
"name": "Login",
"values": [
{
"value": "https://gmail.com",
"type": "link"
},
{
"value": "john@gmail.com",
"type": "email"
},
{
"value": "P@ssw0rd!2025",
"type": "secret"
},
{
"value": "JBSWY3DPEHPK3PXP",
"type": "totp"
},
...
]
}Encryption Format
Encrypted data follows a structured format that includes version information, cryptographic parameters, and the ciphertext. This enables backward compatibility and future algorithm upgrades.
Format Structure
Encryption version identifier (current version is v2)
Base64-encoded 128-bit random salt
Base64-encoded 96-bit initialization vector
Base64-encoded encrypted data with auth tag
Native browser cryptography
All cryptographic operations use the Web Crypto API, a low-level interface provided by modern browsers for performing cryptographic operations.
Benefits of WebCrypto
- Hardware-accelerated performance
- Constant-time implementations prevent timing attacks
- Key material can be marked as non-extractable
- No external JavaScript dependencies
- Audited and maintained by browser vendors
Browser Compatibility
Supported in all modern browsers: Chrome, Firefox, Safari, Edge, and their mobile counterparts.
// Derive AES key from password
const keyMaterial = await crypto.subtle
.importKey(
'raw',
encoder.encode(password),
'PBKDF2',
false,
['deriveBits', 'deriveKey']
);
const aesKey = await crypto.subtle
.deriveKey(
{
name: 'PBKDF2',
salt: salt,
iterations: 600000,
hash: 'SHA-256'
},
keyMaterial,
{ name: 'AES-GCM', length: 256 },
false,
['encrypt', 'decrypt']
);
// Encrypt with AES-GCM
const ciphertext = await crypto.subtle
.encrypt(
{ name: 'AES-GCM', iv: iv },
aesKey,
plaintext
);Version History
Hexbon stays aligned with industry security standards while preserving backward compatibility and allowing seamless, easy migration.
Version 2 (v2)
Current standardPBKDF2 with 600,000 iterations (OWASP 2025 recommendation). All new encryptions use v2. v1 data is automatically upgraded to v2 when you save changes - no manual input required.
Version 1 (v1)
Original releasePBKDF2 with 150,000 iterations. Still supported for decryption of existing data.
Ready to secure your data?
Create your free account and experience truly private data storage.
Get Started Free