THE DETAILS THAT MATTER

A closer look at security.

An encrypted local vault, a deliberate choice before filling, and a direct connection between your devices.

Describes the shipped Safe Haven 2.0.4 implementation.

Encrypted vault contents

Both platforms encrypt vault contents with AES-256-GCM. Windows derives its vault key using scrypt. Android uses PBKDF2-HMAC-SHA256 with 600,000 iterations. These are different platform implementations; Safe Haven does not claim that every part of both apps is identical.

A strong master password is important. Local encryption does not protect a device that is already compromised or stop someone who can unlock your vault from viewing its contents.

Sync goes directly between paired apps

Windows and Android pair with a device-specific connection. Sync uses certificate-pinned TLS while both vaults are unlocked and reachable on the same network. There is no hosted Safe Haven vault service that you have to sign into.

Filling with intention

The browser extension uses the registered native companion to communicate with the Windows app. Website and document checks, item selection and fill-specific authorisation help keep saved details tied to the intended request.

Payment filling checks the current recognised fields and their visibility. Covered or changed fields can be refused. This means some checkouts may need manual entry; a refusal is not a reason to turn off protection. Safe Haven fills card details and never presses a site's payment button.

Passkeys you can take between your devices

Safe Haven stores website and app passkeys in its encrypted vault and can sync them to a paired device. They are not advertised as hardware-bound or non-exportable. Passkey use depends on supported operating-system services, website or app support, and provider setup.

Verify the app you install

Use the public release downloads on this site and compare their SHA-256 checksums if you want to verify file integrity. A checksum confirms the file matches the published release; it is not an independent security certification.

Android updates are signed with Safe Haven's existing Android signing key. The current Windows passkey provider has a locally signed publisher identity; its setup may ask you to review and trust that identity. Windows or your browser may display an application reputation warning. Do not bypass a warning you do not understand.

A few good habits

• Keep your operating system, browser and Safe Haven up to date.
• Check the website's address before filling sensitive information.
• Lock your device and vault when you leave them.
• Protect exports and backups as carefully as the original vault.
• Review payment details yourself before submitting a transaction.

For setup steps and platform requirements, see the help guide. To understand data handling, read Privacy at Safe Haven.