Security
Locked on your PC. Only you hold the key.
Keys Wallet & Watch is built so that nobody but you can read your passwords: not a thief with your laptop, not our sync server, and not us. Here's how it works in plain terms, and where the protection stops.
Is Keys Wallet & Watch secure?
Your vault is encrypted on your own PC with AES-256, a strong and widely trusted standard, using a key made from your master password. That password is never stored or sent anywhere, and it's deliberately slow to guess, so trying one password after another gets a thief nowhere. Sync and sharing are locked the same way before anything leaves your PC, so our server only ever holds copies it can't open. The risks that remain are the ones no password manager can remove: a weak or leaked master password, and harmful software already running on your PC while the vault is open.
How your vault is protected
Four things that keep your passwords private
All of this happens on your PC. None of it depends on our servers.
Your master password stays with you
It unlocks the vault and is then forgotten. It's never saved on the PC and never sent to us, so there's no copy anywhere to steal.
Guessing is made slow
Every guess at your master password costs real computer time and memory, and wrong tries in the app add a growing wait. Running through a list of common passwords isn't practical.
Everything is locked as one
Logins, cards and notes are saved together in one locked file. Without your key it's unreadable, and any tampering with it is detected.
It locks when you walk away
After 5 idle minutes by default, and straight away if someone connects to the PC remotely. Screenshots and screen recordings show a blank window.
Recovery key
No back door, so keep your spare key safe
There is no "forgot password" link, because nobody has a copy of anything that could open your vault.
When you set up a vault, Keys Wallet & Watch offers a recovery key: a long random code that starts KWWRK-. It opens the vault without your password. Print the recovery sheet and keep it with your important papers. After you use it, the app asks you to choose a new master password.
If you make a new recovery key later, the old printed one stops working, and the app reminds you to print the new one.
If you lose both
Without the master password and without the recovery key, the vault cannot be opened: not by you, not by Beckham Enterprises, not by anyone. That is the same thing that stops a thief. Keep a backup of the vault and the printed recovery key in a different place from your PC.
Sync and sharing
Our server carries your vault. It can't read it.
Your PC locks the vault before sending it and unlocks it after it arrives. The sync server in between only ever holds a copy it can't open.
Your PC
Opens with your master password. Locks up every change before it leaves.
Readable only hereOur sync server
Passes the locked copy along and keeps 30 days of earlier versions, in case you need one back.
Can't read itYour other PC
Picks up your changes within a minute and fits them in with its own.
Readable only hereNew PCs need your OK
A PC can only join your vault after you approve its short code on a PC that already has it. Codes expire after 5 minutes.
Sharing starts with a quick check
Before someone joins a shared project, the two of you read out a short code by phone or in person. That proves nobody has slipped in between you.
Access can be taken back
Remove someone from a shared project and they get nothing new. Their copy is deleted the next time their app goes online.
Breach check
Checks for leaked passwords without sending yours
Have I Been Pwned keeps a public list of passwords found in data breaches. Keys Wallet & Watch can check your passwords against it without any of them leaving your PC:
- Your PC scrambles the password into a fingerprint.
- It sends only the first few characters of that fingerprint. Hundreds of different passwords share them.
- The service sends back every leaked password that starts the same way, and your PC looks for a match itself.
The service never learns which password you checked, or whether it matched. The check runs only when you press it, and the app reminds you to repeat it every 3 months. The details.
Honest limits
What it protects against, and what it can't
No password manager protects against everything. Here's a straight account.
Protected
- Someone copies your vault from a stolen laptop, a backup drive or a cloud folder. Without your master password or recovery key it's unreadable, and guessing is slow.
- Our sync server is broken into. It holds no keys, so there's nothing readable to take.
- Someone tries to slip into a shared project pretending to be your colleague. The code you compare by phone gives them away.
- Someone walks up to an unattended PC. The vault locks itself after a few idle minutes.
- Screen sharing and screenshots. The window shows up blank, and remote sessions lock the vault.
Not protected
- Someone who knows or guesses your master password, or finds your recovery key. Use a long master password you don't use anywhere else, and keep the key safe.
- Harmful software already running on your PC while the vault is open, such as a program that records your typing. Keep Windows and your antivirus up to date. The app reports what Windows says about your antivirus and warns when it spots a known monitoring program, but it can't remove one.
- A person you removed from a shared project keeps whatever they already saw or wrote down. They get nothing new.
- Our sync server can see that you sync: your device names, how big your vault is and when it changes, though never what's inside. The privacy notice lists everything it keeps.
- Passwords you copy sit on the Windows clipboard until it clears, where other running programs could read them. They're kept out of Windows clipboard history.
The app itself
Signed, quiet and yours
Signed by us
The installer is signed by BECKHAM ENTERPRISES, LLC, so Windows can confirm it came from us. Updates are checked the same way before they install.
Nothing sent about you
No analytics, no ads, no trackers. The app only goes online for your license, for updates, for breach checks when you ask, and for sync if it's on.
Works offline
Your vault opens without the internet and without our servers. If we disappeared tomorrow, your passwords would still be on your PC.
Want the technical details? Encryption settings, what the sync server stores, and how to check a download.
FAQ
Security questions
Can Beckham Enterprises see my passwords?
No. Your vault is locked on your PC with a key made from your master password, and that password is never stored or sent anywhere. If you use sync, our server only ever receives the vault already locked. Nobody at Beckham Enterprises has anything that could open it.
What encryption does Keys Wallet & Watch use?
AES-256, the widely used standard for strong encryption, with your master password deliberately made slow to guess so that trying millions of passwords isn't practical. Each shared project gets its own key, which only its members can open. The exact algorithms and settings are on the technical details page.
What happens if I forget my master password?
There is no reset, by design: nobody else has a copy. The way back in is the recovery key the setup wizard offers (a 40-character code starting KWWRK-). Print it and keep it somewhere safe. Without the master password or the recovery key, the vault cannot be opened by anyone, including us.
What if my laptop is lost or stolen?
Whoever has it finds a locked vault. Without your master password or recovery key it can't be opened. If you use sync, your other PCs still have everything: on one of them, remove the lost laptop from your synced devices, then change your master password, and the laptop gets nothing new. Without sync, restore your latest backup on the new PC.
How does the breach check work without sending my passwords?
Your PC turns each password into a scrambled fingerprint and sends only the first few characters of it to Have I Been Pwned, a well-known public list of leaked passwords. The service sends back hundreds of possible matches, and your PC checks the list itself. The password never leaves your computer, and the service can't tell which one you were checking. How it works in detail.
Does Keys Wallet & Watch track how I use it?
No. The app sends nothing about how you use it. It only goes online to check your license, to look for updates, to check passwords against known breaches when you ask it to, and to sync if you turn sync on.
See it for yourself, free for 30 days
Try every feature free for 30 days. If you keep it, it's $24.99 once for up to 5 PCs.