How CQRME protects your data
Updated October 17, 2026
CQRME is built on one rule: your passwords are encrypted on your computer, and nothing leaves the vault without your approval. Here is exactly how that works.
Encryption
- Your vault is encrypted with AES-256-GCM. GCM also detects tampering, so a modified vault won't open.
- The key is made from your master password with PBKDF2-SHA256 at 600,000 iterations and a random salt. That makes guessing your master password slow and expensive.
- Your master password is never stored and never sent anywhere. Every save uses a fresh random value (IV), so the same data never encrypts the same way twice.
- CQRME uses the browser's built-in Web Crypto. It contains no third-party code.
The PIN
Unlocking with your master password opens the vault. Your 4-digit PIN then approves each fill, each copy from the toolbar and each reveal.
- The PIN's hash is stored inside the encrypted vault, so it can't be attacked while the vault is locked.
- After 3 wrong PINs the vault locks completely, and only your master password opens it again.
- While unlocked, the vault key lives only in the browser's memory. It is never written to disk and disappears when the browser closes.
Websites can't read your PIN or your vault
- The PIN box runs in an isolated frame that belongs to CQRME, not to the website. The page can't read what you type into it.
- A website can only ask CQRME to start a fill. It never sees the vault, the list of saved logins or any entry you didn't approve.
- When a fill is approved, CQRME checks the page is still on the same site before handing over the one entry you chose.
Phishing guard
Each login is tied to the site it was saved for. A login for example-bank.com is offered on www.example-bank.com and login.example-bank.com, never on example-bank-secure.net or example-bank.com.evil.io. If you choose a login on the wrong site, CQRME warns you before filling anything.
Duress PIN
You can set a second PIN that opens a decoy vault. The decoy is a separate vault with its own encryption key, and it contains only what you put in it. Entering the duress PIN switches CQRME to the decoy and locks the real vault, which only your master password can reopen. The duress PIN can never delete your real vault.
Where your data lives
- On your computer. The encrypted vault is stored in the browser's extension storage.
- In your own cloud drive, if you choose. Sync writes one encrypted file (
CQRME-vault.cqrme) to a folder you pick in OneDrive, Google Drive or Dropbox. Your drive provider stores an encrypted file it can't read. - Not with us. CQRME has no account system and no vault server. There is no CQRME database of passwords to breach.
Automatic protection
- CQRME locks after inactivity (15 minutes by default), when your computer locks or sleeps, and when the browser closes.
- Passwords you copy are cleared from the clipboard after 30 seconds.
- Every fill is recorded in an encrypted activity history, so unexpected use stands out.
Breach check
The optional breach check uses the Have I Been Pwned range API. Only the first 5 characters of a SHA-1 hash of each password leave your computer, which is not enough to identify the password. The full match happens on your computer.
What's next
- An independent third-party security audit, with the report published here.
- Argon2id key derivation. The vault format records its key settings, so existing vaults can be upgraded.
- Unlock with Windows Hello or a hardware security key.