Encrypted on your device. Unreadable everywhere else.
OnlyWallet is built so that we cannot read your vault, even if we wanted to. Here is exactly how, and where the limits are.
From your password to a sealed vault.
Five steps, all on your device. The server only ever receives the last step's output.
Your master password
Typed on your device and never sent anywhere. Not to us, not to Google.
Argon2id stretches it
A memory-hard key derivation: 64 MiB and 3 passes on phones, 19 MiB and 2 passes on the web, with a random salt per account.
It unwraps your vault key
A random 256-bit key created on your device. It lives in memory only while the vault is unlocked.
The vault key seals everything
Every field, note, scanned text and file key is encrypted with AES-256-GCM, each tied to its own record so it cannot be swapped.
Files go to your own Drive
Each file gets its own key and a meaningless name in an OnlyWallet folder in your Google Drive.
The same record, two points of view.
- Full name
- Asha Rao
- Passport number
- Z4829163
- Date of expiry
- 14 Mar 2031
- File number
- BN1068243926
"templateId": "passport",
"expiryDate": "2031-03-14",
"titleEnc": "Q6eBKbAajrM6hqau+EGCfxKci4nY4bG7ORChWg==",
"encV": 2,
"enc": {
"v": 1,
"iv": "ByAQOXuzVwXTmdOF",
"ct": "aig9BaweEQEhkUmY3SnlXBQ+CadPgw6jSv94QQx4yuVbmAyXKRUYgETT0RrPBqAhytBz7IK3/mGlmi6qaZzK7/HXzm3zlAuOa/HWhdBuMwHxtxaLrxGX3Bnrve7QDxhl"
}Every field is sealed with AES-256-GCM before it leaves your device. Dates, amounts and the document type stay readable so reminders can reach you; a private title is encrypted too. Sample record, fictional person.
What our servers can and cannot see.
Encrypted, unreadable to us
- Every field of every document: numbers, names, addresses, PINs, CVVs
- Passwords, one-time code keys and notes
- Scanned and recognised text
- Attached files, their thumbnails and their file names
- Private titles, names of spaces and of the people in them
- Payment notes
Readable, so the app can work
- Titles you have not marked private, tags and the document type
- Dates, amounts and payment status, so reminders and the calendar work
- Family profile names and dates of birth
- Email addresses of people you share a space with, and their roles
- The number, size and upload time of files in your Drive
Mark a title private to move it to the left column. Reminder pushes carry only generic text, such as "A payment is due soon".
Your recovery phrase is the only spare key.
When you create a vault, OnlyWallet shows 24 words once and asks you to confirm three of them. The phrase can set a new master password on any device. It is never stored by us, so keep it on paper, away from your phone, email and cloud notes.
Protection on the device, too.
Auto-lock
In the background and after idle time on screen, from immediately to 15 minutes.
Back-off on wrong passwords
After five wrong tries, each attempt waits longer, up to 15 minutes, even across restarts.
Biometrics done properly
On phones, the key sits in Android Keystore or iOS Keychain and needs your fingerprint or face on every use.
Screen privacy
Screenshots and recording are blocked on Android; every platform hides the app in the app switcher.
Clipboard hygiene
Copied secrets are marked sensitive, kept out of keyboard history and cleared after 30 seconds and on lock.
Sign-out wipe
Signing out clears the offline cache, pending edits, the clipboard and any temporary decrypted files.
What encryption cannot do.
No system is perfect. These are the limits we know about, stated plainly.
- A weak master password can be guessed offline by someone who obtains a copy of your encrypted key. Use a long passphrase.
- Vaults created on the web use a lighter Argon2 setting because browsers are slower. The first unlock on a phone upgrades it.
- iPhones do not let apps block screenshots. OnlyWallet covers the app switcher only.
- An emergency contact who is granted access can read and copy your personal vault. Choose someone you trust completely.
- Anyone in a shared space can keep what they have already seen. Removing them protects what you add later.
- A compromised phone or browser, or a phishing page, can capture what you type. Only use app.onlywallet.in or the official apps.
Found a problem? Email [email protected]. See also our privacy notice.
Security questions
Can OnlyWallet reset my master password?
No. We never have your password or your vault key, so there is nothing for us to reset. Your 24-word recovery phrase can set a new password. Without the password and the phrase, the vault cannot be opened by anyone.
Does Google see my documents in Drive?
Google stores the files, but only as encrypted blobs named with random IDs. The keys never leave your devices, so neither Google nor OnlyWallet can open them. OnlyWallet asks only for access to files it creates, not your whole Drive.
What happens if OnlyWallet’s servers are breached?
An attacker would get ciphertext plus the readable details listed on this page, such as dates, amounts and non-private titles. Fields, files and keys stay encrypted. They could try to guess weak master passwords offline, which Argon2id makes slow and expensive.
Which encryption does OnlyWallet use?
Argon2id to derive a key from your master password, AES-256-GCM with random 96-bit nonces for every encrypted field and file, HKDF-SHA256 for the recovery phrase, and X25519 sealed boxes to share keys with family members and emergency contacts.
How do I report a security issue?
Email [email protected] with the details and steps to reproduce. Please give us reasonable time to fix it before you publish. Our security.txt file is at onlywallet.in/.well-known/security.txt.
Put your important things somewhere safe.
Open the web app, sign in with Google and create your master password. Your vault is ready in a few minutes, and it is free.