Security
How Jaal protects your passwords and browsing
Passwords are encrypted before they leave your computer, new devices need your approval, and the browser warns you about dangerous sites.
Passwords
End-to-end encrypted passwords
Your saved passwords and passkeys are encrypted on your computer before they sync. The Ulkaa server stores ciphertext only and cannot read them.
- Records are encrypted with AES-256-GCM on your device
- The key is protected by a recovery code or an Argon2id passphrase you choose
- Jaal fills a password only on the exact site it was saved for
Approving a new device
A new computer cannot read your passwords until you approve it from one you already trust.
- The two devices connect through a relay using an X25519 key exchange
- You check a fingerprint, then both devices show the same six-digit code
- If the codes differ, deny the request
Breach check
Jaal can tell you when a saved password appears in a known breach, without sending the password.
- It uses k-anonymity: only a short prefix of a hash leaves your device
- The match is made on your computer, against the list that comes back
Your sign-in
Jaal has no sign-in of its own. The Ulkaa Account app signs you in the standard way and hands Jaal short-lived tokens, and every session is listed in your account.
- OpenID Connect with PKCE
- Jaal never holds a refresh token; it lives only in Ulkaa Account
- Sessions are listed in your Ulkaa account
- Ulkaa Workspace checks your role on every request, so a workspace you are not in shows nothing
Browsing
Safe browsing
Jaal checks the connection and the site before the page shows.
- HTTPS first: Jaal tries the secure version of a site
- A warning page appears before phishing and malware sites
- Sites ask before using your location or other permissions
Private windows and Guest
Two ways to browse without mixing it into your profile.
- A private window is kept apart from your profile
- Guest lets someone else use the browser without your profile
Review status
Jaal’s encryption has not had an external security review yet. We will publish one when it has.
A browser that is already signed in to Ulkaa
Jaal is free, and so is sync. It runs on Windows, and other systems are being tested.
Jaal is powered by S Technologies, made for Ulkaa.