Frequently asked questions

Do I need an account or a server?

No account. Sync works between paired devices over direct connections. Optional rendezvous, relay, mailbox, and object-storage services help with NAT traversal, discovery, and all-devices-offline catch-up. They are untrusted and hold no vault keys.

Does a server ever store my vault?

The optional services carry encrypted opaque data. The pairing rendezvous stores only encrypted pairing envelopes and never receives the pairing capability, vault plaintext, or envelope keys. Object storage holds epoch-encrypted bundles under capability-scoped access. Paired devices remain the authority for vault state.

What happens when two devices edit the same entry?

Lattice records a redacted conflict descriptor. You inspect the candidates and commit a signed, journaled resolution. Exact retries are idempotent, and stale peers cannot resurrect a resolved conflict. Losing payloads stay in an encrypted quarantine until a proof-gated pruning operation retires them.

Are my KDBX key files synchronized?

No. Key files are local credentials and are never synchronized. Provision the same key material separately on each device. Their paths may differ between devices.

What happens if I lose a device?

Remove the lost member to advance the membership epoch and rotate secrets. A lost non-admin writer identity can be replaced with fresh keys through a two-code recovery flow. A lost admin is restored from an encrypted offline admin backup or replaced by a previously enrolled secondary recovery authority.

Is Lattice PM a backup tool?

No. It synchronizes vaults between trusted devices. It is not a replacement for backups or for KeePass credential hygiene.

Which KDBX versions and platforms are supported?

KDBX4.1 with password-only, password-plus-key-file, or key-file-only credentials is supported. Production targets are Linux and macOS. A bounded Windows port is in progress and Windows release artifacts are not produced yet. The desktop GUI is a read-only status shell, and mobile companions are in progress.

How is this different from a hosted password manager?

There is no provider account and no provider-held key. Your devices exchange signed revisions directly, and Lattice writes the merged result back to a real KDBX file that KeePass and KeePassXC can open. Optional services can be self-hosted.

How is it licensed?

Dual licensed under Apache-2.0 or MIT, at your option. The source is atgithub.com/ocpu/latticepm.