NexusSecurity
What protects your data, and what does not
We would rather tell you the limits up front than have you find them later.
What Nexus does
| Encryption | Vault contents are encrypted with AES-256-GCM. |
|---|---|
| Key derivation | Your encryption key is derived from your master password with Argon2id (128 MB of memory, 4 iterations). |
| Offline | Encryption, decryption and license-key checks all happen on your PC. There is no account and no server holding your data. |
| Network use | One optional call: the update check, which talks to GitHub only. It sends nothing about you or your vault, and you can turn it off in Settings. |
| Telemetry | None. No analytics, no crash reporting, no usage tracking. |
| Recovery | A 24-word recovery phrase you keep yourself. There is no cloud password reset. If you lose the password and the phrase, the vault cannot be recovered. |
| Protection layers | Auto-lock, anti-tamper checks, a clipboard guard, screen-capture protection, an HMAC-chained activity log, honeypot files, a decoy vault and a panic wipe hotkey. |
What we do not claim
- Nexus has not been independently audited or certified by anyone. We publish no benchmarks and no certifications we have not earned.
- The code is closed source, so you cannot inspect it yourself.
- The program is not code-signed yet. Windows will warn you the first time you run it.
- No vault can protect a PC that is already compromised, for example by malware running as you.
- Some recent features have not had enough hands-on testing yet. The known issues page says which.
Check what you downloaded
Every release ships a SHA-256 hash next to the program. Compare it with your copy before you run it. The download page walks through it.
Report a vulnerability
Please do not open a public issue. Email atharva.patil.cg@gmail.com or message us on Discord. The security policy explains how we handle reports.