Master password — only in your head
The master password is typed only on your device and never leaves it. Afina servers don't see it on signup, login, or sync. Without it you have no access to decrypted data — and neither do we.
Zero-Knowledge by design
We can't decrypt your data. Nobody can.
The secret encryption key is generated on your device and sealed with a master password you remember — you don't store it anywhere. Afina holds neither the key nor the master password, so nobody, including us, can read your data in clear. Ever.
That's why we never hold your data in clear — not in logs, not in backups, not in cache.
01 — Master password
You remember the master password — you don't store it. Afina never sends it to a server: not on signup, not on login, not on sync. It lives only locally, just long enough to decrypt your secret key.
02 — Client-side secret key
On first launch Afina generates a secret key locally and seals it with your master password. Cookies, vault secrets and account variables are sealed with that key before they ever touch storage.
03 — Signed everything
Extensions, RPA scripts and Node.js modules are signed with Ed25519 over an md5 manifest of their files. Change one byte and the signature breaks — the executor refuses to run it. No silent supply-chain swaps.
Four guarantees nothing else in antidetect gives you
Afina is architected so that, mathematically, we have no way to read your data. Here's what that buys you in practice.
Sealed vault for every secret
Every sensitive value — account passwords, seed phrases, cookies, API tokens, IMAP credentials — is sealed with your local key before it touches disk. Storage only sees sealedBox(...) blobs.
Ed25519-signed code
Extensions, RPA scripts and Node.js modules carry an Ed25519 signature. Before every run the executor verifies it against an md5 manifest of every file in the module. One altered byte — no run. No silent supply-chain backdoors.
No recovery — by design
There is no "I forgot my master password" button. A reset wipes the encrypted blobs because we mathematically cannot decrypt them. Same model as a non-custodial crypto wallet: you own the key, you own the responsibility for storing it.
How Afina compares to other antidetect browsers
CapabilityAfinaMost others
Master password leaves your machineNeverSent on login
Account secrets readable by vendorNoYes
Extensions cryptographically signedEd25519Trust the vendor
RPA modules cryptographically signedEd25519Often unsigned
Password recovery by vendorImpossibleCommon
Cookies encrypted with your keyYesMostly server-side
Cloud optional + Google DriveYesVendor cloud only
FAQs
If we can't read it, nobody can read it
Install Afina, set your master password — the secret key stays on your device, fully under your control.