No. Encryption and decryption happen right in the browser – not only for passwords, but for entries, folder names and custom fields too. The FreeScout server stores only encrypted data and the non-confidential details it needs to run. The master password and the unencrypted key never leave the browser. Argon2id and AES-256-GCM are used, with their own parameters per record.

A personal recovery key and a printable Emergency Kit are created when you set up – both belong somewhere outside FreeScout. Keep at least one of them: because the server cannot decrypt the contents, it cannot give the access back either. That is the price of the zero-knowledge approach, and at the same time its point.

Yes, through shared vaults – separate ones for IT, accounting or support, say. Every member has a clear role: Owner manages the vault and its members, Edit may view and change, View may only read. The vault key is provided encrypted individually for each member, so it never has to be passed around in the open.

Thirteen prepared entry types with fitting fields: login, secure note, payment card, identity, SSH key, API credentials, bank account, database, document, crypto wallet, server, software licence and Wi-Fi access. Plus custom fields and free notes.

Yes. On every change the previous version moves encrypted into the entry's history, and from there you can bring it back. Deleted entries go to the recycle bin first.

No. A login entry can hold a TOTP key – typed in or captured by QR code. The module works out the six-digit code in the browser and keeps it current, right next to the password.