Alice opens Keyra™ on her desktop and creates a vault secured with Active Directory trust for Team One.

Alice emails the Keyra™ vault to Bob. Eve intercepts the email and the vault file!

Alice & Bob exchange secrets via messenger. Keyra™ encrypts every message for the Team One vault.

Eve was not in the AD group. Keyra™ won't decrypt anything without Team One vault membership!

In Keyra™, Alice creates a vault with YubiKey auth. She emails the vault and mails the YubiKey separately.

Eve intercepts the email with the Keyra™ vault, but the YubiKey goes by physical mail - a separate channel!

Alice & Bob exchange secrets via messenger. Keyra™ encrypts every message — YubiKey required to decrypt.

Without the physical YubiKey, Keyra™ won't unlock the Team One vault. Hardware tokens win!

Alice opens Keyra™ and creates a vault with two passwords. She sends them via separate channels: email & SMS.

Eve intercepts the email with Password #1 & the Keyra™ vault, but Password #2 went by SMS!

Alice & Bob exchange secrets via messenger. Keyra™ requires both passwords to unlock the vault.

With only one password, Keyra™ refuses to decrypt. You need both or you get nothing!

Alice uses Keyra™ to push encrypted passwords & files to a Git repo. Keyra™ handles vault encryption & Git sync.

Bob runs Keyra™ to pull encrypted data from the Git repo. His vault key decrypts everything locally.

Eve hacks into the Git repo and downloads all the Keyra™-encrypted passwords and files!

Without Keyra™ vault keys, Eve's stolen files are just useless encrypted junk. The secrets remain safe!

Keyra™ lets each team member pick their own auth method. Alice secures her access with two YubiKeys.

Keyra™ supports per-user auth. Bob picks 1 YubiKey + 1 password to access the same Team One vault.

Keyra™ lets Alice & Bob each unlock the same vault with their own preferred authenticators. Seamless teamwork!

Keyra™ per-user auth means Eve would need to steal different credentials for each person. One attack can't compromise everyone!