What Does "Offline" Mean in LockYit?
LockYit describes itself as an offline-first secure information manager. But what does that actually mean in practice? Where does your data live, and what goes to the cloud? Let's break it down clearly.
Your Vault Data Stays on Your Device
Everything you create inside LockYit - your passwords, secure notes, credit cards, identities, API keys, and all other vault items - is stored only on the device you are using. It is never uploaded to any server, and it never leaves your device unless you explicitly export or back it up yourself.
Your vault data is encrypted using AES-256-GCM encryption before it is even written to storage. The encryption key is derived from your master password, which only you know. This means that even if someone gained physical access to your device, they would not be able to read your data without your master password.
There is no background cloud sync, no cloud database, and no server-side copy of your vault. When you are offline, LockYit works exactly the same as when you are connected to the internet - because your data never depended on the internet to begin with.
What Is Stored in the Cloud?
Your LockYit account - the account you use to sign in - is managed on our servers. This includes your email address, cryptographically secure authentication credentials, two-factor authentication settings, and your encrypted recovery key.
This account exists to give you essential security management features: changing your master password, enabling or disabling two-factor authentication, and recovering access to your vault if you ever need it. These features require a server to be useful - a recovery key you can only access from a single device is no recovery at all.
Importantly, your vault data is not part of your account. Signing out or deleting your account from a device does not touch your vault. The two are separate by design.
The Benefits of an Offline-First Approach
No cloud breach can expose your data
With mainstream cloud-based password managers, a server-side breach can potentially expose millions of users' data at once. With LockYit, there is no central vault to breach. Your data exists only on your device, in encrypted form.
No internet required
Your vault is always available - on a plane, in a remote area, or during an outage. LockYit never needs to "sync" or "fetch" your data because it is already there.
You are in full control of your data
You decide where your backups go, who has access to your devices, and what happens to your data. No third party is holding your information on your behalf. If you want to move your data, export it. If you want to delete it, it is gone from your device the moment you clear it.
No subscription required to access your own data
Because your data is local, you always have access to it regardless of your plan or account status. Offline data does not disappear if a subscription lapses or a service shuts down.
Smaller attack surface
Every network connection is a potential attack surface. By keeping your vault entirely local, LockYit eliminates the risk of man-in-the-middle attacks, server-side vulnerabilities, and network interception - because your vault data never travels over a network at all.
Privacy by design
We cannot see your data because we never have access to it. There is no telemetry on your vault contents, and no possibility of your data being used for any purpose - because it simply does not exist on our side.
Being offline-first is not a limitation - it is a deliberate security architecture. Your vault is yours, stored on your device, encrypted with a key only you hold. That is what offline means in LockYit.
If you have questions about how LockYit handles your data, see our FAQ.