Encrypted Vault encrypts your files in your browser, and the names of those files too. Some information about your files isn't encrypted. This guide sets out exactly what's protected by your passphrase and what we can see, so you can decide how to store sensitive files.
Protected by your passphrase
- The contents of encrypted files. Files uploaded with Encrypt files I upload (recommended) ticked are encrypted with AES-256-GCM in your browser before upload. We only ever store the encrypted version.
- The names of encrypted files. Your browser encrypts each name with the same key and decrypts it when you open your vault. We store only the encrypted name.
- Your passphrase and encryption key. Neither is ever sent to us. We store a small encrypted test value so the vault can tell you if you type the wrong passphrase, and it's useless without your passphrase.
Files you uploaded before names were encrypted
Files you uploaded before names were fully encrypted also have a readable copy of their name on our side. The next time you unlock your vault, your browser checks that the encrypted copy of each name opens with your passphrase and matches, and only then do we delete the readable copy. This only happens once your passphrase has been checked against the one already set for your vault: if you're asked to set a passphrase for files you already have, it starts the next time you unlock after that. You'll see a short note at the top of your vault while it happens. You don't need to do anything else.
A few older files have no encrypted copy of their name, and names of files uploaded from a PremierVPN app stay readable for now. To encrypt one of those names, unlock your vault and rename the file.
Not protected by your passphrase
To list and manage your files, the vault stores the following in readable form, so we can see it:
- Folder names and how your folders are arranged.
- File types (for example PDF or JPEG), file sizes and upload dates.
- Which files are starred and shared, and share link settings such as expiry and download counts.
- Files uploaded without encryption, including their names. These are marked Not encrypted in your file list.
Where encrypted names appear
- In your vault: names appear once you've unlocked it in that browser tab. If you open Starred files before unlocking, or a name can't be decrypted with your passphrase, it shows as Encrypted name.
- On a share page: the person you share with sees Encrypted file until they enter your vault passphrase. The real name appears, and the file is saved with it, once it's decrypted.
- In the dead man's switch email: your emergency contact sees each encrypted name as Encrypted file followed by a number, for example Encrypted file 2.
Files whose names haven't been encrypted yet (see above) show their readable name in all three places.
Keep folder names neutral
Folder names aren't encrypted, so avoid putting anything sensitive in them. If a file would give something away just by being in a particular folder, keep it at the top level or in a folder with a neutral name.
For more ways to keep your vault safe, see Vault Security Best Practices.