BobWork VaultThe short version
- Your master password never leaves your device. It is stretched with PBKDF2-SHA256 (600,000 iterations), then split with HKDF into an encryption key and a separate sign-in proof.
- Each password has its own AES-256-GCM key. That key is encrypted (“wrapped”) for every person allowed to open it, using their personal P-256 key pair.
- The server stores ciphertext, wrapped keys and public keys only. Sharing happens in a teammate’s browser, never on the server.
- New devices need an email code on top of the master password; sessions expire and lock automatically.
Sharing without exposing
Access levels are Owner, Edit, View and Login only. Login only lets a teammate sign in with a password the extension fills for them, without showing or copying it — useful for shared tools, agencies and contractors.
When someone leaves, the guided offboarding flow removes their access, hands over what they owned, gives every remaining shared password a new encryption key, and builds a checklist of passwords to change on each site.
What we can and can’t do
| We can | We can’t |
|---|---|
| See your email, name, organisation, and which items exist and who they’re shared with | Read any password, username, URL, note or 2FA secret |
| Delete an account or suspend a member on an admin’s request | Reset your master password and keep your data — unless your organisation turned on admin-assisted recovery and you enrolled |
Breach checks use Have I Been Pwned’s k-anonymity API from your browser: only the first 5 characters of a password’s SHA-1 hash are sent, and the result never reaches our server.
Account recovery
By default nobody — including BobWork — can recover a forgotten master password. Organisations can opt in to admin-assisted recovery: each member chooses to enrol, and an admin can then help them set a new master password without ever seeing their passwords.
Questions
Can BobWork see my passwords?
No. Passwords are encrypted in your browser with AES-256-GCM before upload. BobWork's servers only store ciphertext.
What encryption does BobWork Vault use?
AES-256-GCM for each item, P-256 ECDH to share item keys between teammates, and PBKDF2-SHA256 with 600,000 iterations plus HKDF to derive keys from your master password.
What happens if I forget my master password?
Nobody can recover it unless your organisation turned on admin-assisted account recovery and you enrolled. Download the Emergency Kit when you sign up and keep your master password somewhere safe.
Is BobWork Vault open about what it stores?
Yes. It stores your email, name, organisation, encrypted items, wrapped keys, public keys and an audit log of actions. Password contents are never stored unencrypted.