We use AES-256 encryption, the strongest encryption technology available. Our encryption is end-to-end, meaning your passwords and wallet information never leaves your computer or device without being encrypted first. All encryption and decryption is performed on your own device, meaning that no readable passwords are ever sent over the Internet, including to our own servers.
Your logins and wallet information are sent over a secure TLS connection to our sync servers, where it is stored exclusively in encrypted form. When you synchronize onto a new device, encrypted data is downloaded onto the device, and decrypted there using your Master Password, which only you know. We generate encryption keys from your Master Password and a salt (a random number).
Your Master Password is never sent over the Internet, and is not stored on our servers. So in the unlikely event that a hacker manages to break through our firewalls and obtain your encrypted data from our servers, they'd still face years of effort to decrypt your passwords. For password sharing, we use RSA-2048 public key encryption, so your passwords are shared in a strongly encrypted form and no private encryption keys ever leave your own devices.
For more details, please see our Security White Paper.