How OurLogins protects you

The encrypted vault

• Your master password is stretched with Argon2id (64 MiB of memory, 3 passes), which makes guessing slow.
• Logins are encrypted with XChaCha20-Poly1305 using a random key. A wrong password, or a file that was damaged or tampered with, is detected and refused.
• Saves are written to a new file first, then swapped in, so a power cut can't leave you with half a vault. The previous version is kept alongside.
• The vault file format is documented and is the same on Windows and Mac, so backups move between them.

Importing a spreadsheet

OurLogins opens the spreadsheet you import read-only and never saves it. Password-protected ("Encrypt with Password") .xlsx files are decrypted in memory using the standard Microsoft method; the password isn't saved. An ordinary Excel file has no encryption at all — anyone who can open it can read it — and "protect sheet"/"protect workbook" settings only stop editing; they do not hide anything. Once your logins are in the vault, consider deleting the spreadsheet.

The browser extension

• It talks only to the OurLogins app on the same computer, through the browser's official native-messaging channel. The app checks which extension and which program is asking.
• It only offers logins saved for the website you're on. "www." counts as the same, and a login saved for a whole site (example.com) also works on its other addresses (login.example.com) unless you saved one for that address. Look-alike addresses, including ones using foreign letters, don't match. A login saved for one address of a site (mail.example.com) needs an extra confirmation on another (shop.example.com).
• It fills only when you ask: the Fill button, its keyboard shortcut, or Fill with OurLogins in the right-click menu. The shortcut and menu fill straight away only when there is exactly one login for the site; otherwise they show the list. It fills only the main page (never inside embedded frames), and it re-checks that the page hasn't changed first.
• It never stores passwords and never asks for your master password.

Updates

The app tells you when a newer version is available and installs it only when you press Install and restart. Every update is signed with our release key, and the app checks that signature before installing, so an update can't be swapped for something else on the way, even by someone who takes over our download server. It also refuses to go back to an older version.

What it can't protect against

• Malicious software already running on your computer with your permissions can watch what you type or read the screen while OurLogins is unlocked.
• Anyone who can use your unlocked computer can use unlocked OurLogins. Lock it, or let it lock itself after a few minutes idle.
• A spreadsheet you imported from is still readable by anything that can open it, until you delete it.
• While OurLogins is unlocked, passwords are in the computer's memory. We clear what we reasonably can, but we don't claim that every copy is erased.

The full threat model and file format are published with the source code.