How strong is the lock on your account?
Last reviewed July 12, 2026 · v1.1
Semparo holds the most sensitive things a person leaves behind: seed phrases, a will, the map of what they own, and the words they want their family to have. So the first fair question from a careful buyer is simple: how hard is it for the wrong person to get into my account? This page walks the ladder of account security from its weakest rung to its strongest, shows where Semparo sits, and says plainly what we do not claim.
The levels below map to the U.S. government's own yardstick for login strength, NIST Special Publication 800-63B, which sorts authentication into three assurance levels by how many independent factors it demands and how hard those factors are to steal.
The ladder, from a pharmacy counter to a vault
Think about picking up a prescription. At most counters you give a name and a date of birth, and you walk out with someone's medicine. That is the bottom rung: one fact, and a weak one, because it is a fact other people can look up. Software climbs from there.
| Rung | Everyday example | What it takes to get in | Where the standard puts it |
|---|---|---|---|
| Name and date of birth | Picking up a prescription | One fact others can look up | Below the ladder |
| Username and password | Most websites | One secret you know | NIST AAL1, single factor |
| Password plus a one-time code | Careful banks and email | A secret you know, plus your phone | NIST AAL2, two factors |
| Password plus a device-held Secret Key plus a one-time code | Leading password managers | A known secret, a strong secret kept on your own devices, and your phone | The strongest password-based tier, where Semparo sits |
| A passkey bound to your device | The newest sign-in on phones | Your device plus your face or fingerprint, and it cannot be phished | Phishing-resistant (NIST AAL2; AAL3 with a hardware key) |
Two factors is the honest floor for anything that matters. NIST is blunt about the bottom rung: AAL1 "requires either single-factor or multi-factor authentication," so a lone password clears the lowest bar and nothing more. A one-time code lifts you to AAL2, which "requires" proof of "two different authentication factors." Most careful services stop there.
Where Semparo sits, and why
Semparo is built at the top of the password-based tier, the same shape used by the best password managers.
- Your password never reaches us. It is turned into an unlock key inside your browser. Our servers only ever see a verifier, never the password itself, so a breach of Semparo yields nothing to sign in with.
- A Secret Key that lives with you, not with us. At setup you get a long, randomly generated Secret Key in your Welcome Kit. It folds into the key that unlocks your vault and it never touches our servers. Leading password managers use the same defense: the device-held key and your password combine to create the full encryption key, and the key is never sent to the provider, so a company breach on its own cannot decrypt your data.
- Every login takes a one-time code. Not just the first sign-in on a new device. Every one.
That is three independent things a thief would need at once: something you know, something only your devices hold, and something on your phone.
The part a login cannot do
A lock is only half the story. A vault has to answer two harder questions: what happens if someone gets past the login, and what happens if the company itself is breached, subpoenaed, or sold to someone you would not have chosen.
On the first, the answer for any serious vault is the same. Your content is encrypted with keys only you hold, so a stolen session or a stolen server yields ciphertext and nothing more. Semparo and the best password managers agree here.
On the second, Semparo adds the piece built for after you are gone. Your vault opens only after you stop responding across every channel and a quorum of the people you chose confirm it under oath, and no single party can open it early. Not a hacker, not a court order served on us, not a Semparo employee, and not Semparo itself. A password manager does not do this, because it is not what a password manager is for. The full mechanism, with every claim linked to the public standard behind it, is on our security page, and the whole cryptographic design is published for anyone to attack in our open paper.
The strongest rung, and how to turn it on
There is one clear step above even a device-held Secret Key, and it is phishing resistance. It is now something you can switch on. A passkey is a credential your device creates and unlocks with the same face, fingerprint, or PIN you use to open the phone. It cannot be typed into a fake site, so the most common attack, tricking you into entering your code on a lookalike page, simply stops working. The FIDO Alliance, which sets the standard, states plainly that passkeys "are phishing resistant and secure by design."
When you turn on passkey sign-in, your every-login code is replaced by a tap on your device, and there is no code left for a lookalike page to ask for. We are careful about how high that reaches. A passkey synced through iCloud or Google is phishing-resistant at NIST AAL2, and the top level, AAL3, is reserved for a hardware-based authenticator like a security key. So we claim phishing resistance for every passkey, and AAL3 only when you use a hardware key. Because there is no typed code to fall back on at this level, we ask you to register a backup passkey when you switch it on, and a lost passkey is recovered through your recovery kit rather than a texted code.
It is nearly free to use. Every recent phone and browser already carries the hardware, so there is no key to buy and nothing to carry. You can turn it on today under Privacy and Security.
What we do not claim
We would rather you trust us for the right reasons, so here is the honest boundary.
- No account is stronger than the secrets you keep. If you lose your Secret Key and your recovery kit both, we cannot open your vault for you. That is the cost of a design where no one at Semparo can read it.
- A one-time code is not phishing-proof. Two factors raise the bar a great deal, but a code you type can, in theory, be entered on a fake page. That is the exact gap a passkey closes, so if that worries you, you can switch to passkey sign-in and remove the typed code entirely.
- Vault content is zero-knowledge; the plumbing is not. We can never read what you store. The operational details we must use to run the service, like your email and phone number, are encrypted at rest but are decryptable by us so we can send you a code or reach the people you chose. We do not call that zero-knowledge, and we would be suspicious of anyone who did.