Privacy & security
Updated 7 November 2026
Twinmapper is built on the zero-knowledge principle: we cannot read the contents of your twins.
As a guest
Your twins are kept only in your browser's storage (localStorage, key tm-guest-vault). Nothing is sent to our server. If you clear your browser data, your twins are gone.
With an account
When you create an account, your browser generates a random 160-bit account key. From your password and that key, your browser derives two separate keys with PBKDF2-SHA256 (600,000 rounds) and HKDF: one to sign in and one to encrypt your data. Your data is encrypted with AES-256-GCM before it leaves your device.
What the server stores
Your e-mail address, a salt, a hash of the sign-in key, your encrypted vault key, your encrypted data and a session cookie. Without your password and your account key none of it can be decrypted.
Lost your password or key?
Because only you hold the keys, we cannot recover your data. Keep your Emergency Kit safe and export now and then.
The cookies and browser storage we use are listed on the cookie page.