Your keys, your data, your control

End-to-end encrypted

Your data is encrypted on your device under a key that only your master password (or your recovery key) opens. We never see either, and we can't recover them. The storage holds only the encrypted copy. Sync works with hosted ZestSSH Cloud or your own WebDAV, S3, or Google Drive storage, with the same encryption either way.

• Your master password never leaves your device
• The key that opens your data leaves your device only wrapped, under your master password or recovery key
• Someone who takes the stored copy gets only ciphertext
• We can't read what you store, and the app has no analytics

What syncs

Everything you need on every device, encrypted before it leaves.

• Hosts, with their tags and settings
• Keys, with their passwords, private keys, passphrases and certificates
• Groups
• Snippets and snippet categories
• Port forwards
• Networks and per-host network settings
• Known host keys
• Alerts, command history and your terminal settings

Cryptography

• AES-256-GCM, authenticated encryption that detects tampering
• Argon2id, memory-hard key derivation, resistant to GPU/ASIC attacks
• HKDF-SHA256, verification key derivation with domain separation
• SQLCipher, local database encryption
• No custom cryptography, all standard, auditable algorithms

Recovery key

When you set up sync, you receive a recovery key (ZEST-XXXX-XXXX-XXXX-XXXX-XXXX), made on your device and shown once. It opens your data on its own if you forget your master password, and then you choose a new one.

Save it somewhere safe. If you lose both your master password and your recovery key, your synced data cannot be recovered. That's the tradeoff of real end-to-end encryption.

Encrypted backups

Local .zest backup files use the same encryption (AES-256-GCM, with a key made from your backup password by Argon2id). Automatic backups are off until you turn them on; then they run daily or weekly and after a change, and the newest 3 are kept. A backup encrypted with a password you choose can be safely stored in Google Drive, iCloud, or Dropbox.