Application Security

Zero-knowledge encryption means your data is encrypted on your device before it reaches our servers. We never have access to your encryption keys, so no one at WIGGWIGG can decrypt your identity information, passwords, or personal data. Only you can unlock your data with your password.

If you forget your password, you can restore access using your 24-word recovery phrase. This is why we strongly recommend saving your recovery phrase in a secure location when you first create your account. Without your password or recovery phrase, we cannot recover your account. This is by design to protect your privacy.

Before you enter your full password, we show you a unique security marker (phrase, color pair, and avatar, with an optional audio signature) that only the real WIGGWIGG can display, if you turned it on at sign-up or in Settings. Its seed is stored sealed under a key derived from the first characters of your password, so a stolen database can't mass-render markers. If your security marker doesn't match, don't enter your password. You're likely on a fake site.

No. Your identity data (names, addresses, passwords, notes) is encrypted on your device before upload. Even if we wanted to, we cannot decrypt your information. We use zero-knowledge architecture specifically so we cannot access your data. Not even with legal requests. One exception: the forwarding phone number on an identity is server-readable so we can route calls.

Application security covers your identity data (names, passwords, personal details). Communications security covers phone calls and SMS/MMS messages. For communications protected by our current sealing method, stored content is sealed to the account communication key, which a supported client opens after sign-in and unlock. A small set retained from the private beta remains readable under our older server-side encryption until a separate re-sealing process. For communications sealed this way, the difference from the vault is not the protection at rest but when that protection begins: we choose to scan SMS and MMS in real time, in memory, before encryption. Preservation or reporting duties can apply if review confirms the content is illegal. A few named exceptions stay readable by our servers; they are listed on the Communications Security page.

Encryption of your vault, identities and contacts happens in your browser with Web Crypto and audited JS/WASM libraries. You can inspect network traffic to verify that this content is sent to our servers as ciphertext. Operational data and telephone content in transit follow separate paths and may be readable by our servers or providers, as described on the Communications Security page. For inbound messages protected by our current sealing method, the one-time key is sealed to the account communication key, which a supported client opens after sign-in and unlock. A small set retained from the private beta remains readable under our older server-side encryption until a separate re-sealing process.

Even if someone breaches our servers, your identity data and vault remain protected. All they would find is encrypted ciphertext that cannot be decrypted without your password. We never store your password, and we never store an encryption key in a form we can open. This is the core principle of zero-knowledge architecture.

Yes. You can export your account data (JSON or HTML) and your vault (Bitwarden JSON or CSV, unencrypted, for moving to another manager). Encrypted-only fields stay encrypted in the account export; WIGGWIGG cannot open them.