Zero-knowledge AES-256-GCM. Ciphertext only ever leaves this page.
⚠ Warning: Secondary emergency backup tool. Keep physical copies safe. The Worker never receives your passphrase or plaintext.
API Endpoint
Switch between local Wrangler and a deployed Cloudflare Worker. Network failures fall back to an encrypted local blob (IndexedDB, then LocalStorage).
Endpoint: not configured yet.
Step 1 · New Vault
1. Account Registration & Master Passphrase
Choose Auto-Generate for a 5-word UPPERCASE passphrase (each word ends with a random digit 0–9), or enter your own custom passphrase. A local AES key and PBKDF2 verifier are derived on this device. Then register the Account ID with POST /api/register — the Worker receives only the verifier hash and salt, never the passphrase.
💡 Security Tip: Custom passphrases must contain at least one number in every word (e.g., EMB3R-CAN Y0N-GLAC1ER-HA3BOR-SUMM1T) to maximize strength.
No passphrase generated yet.
Security requirement: Every word in your passphrase must contain at least one number (e.g., C4NYON).
No vault initialized on this device yet.
Step 2 · Daily Use
2. Unlock Vault
In Auto-Generate mode, tap your passphrase on the keys below (A–Z, 0–9, and SPACE). Physical typing is disabled and input is masked. In Custom Passphrase mode, unlock uses the custom field in Step 1. Unlock derives the local AES key, then authenticates with POST /api/login. On a new device, enter your existing Account ID above — no local registration session is required.
Documents
Storage Used: 0 KB / 50 MB
Encrypt in-browser with AES-256-GCM, then upload each file as its own ciphertext blob. The Worker stores only opaque bytes plus an encrypted metadata list — filenames never leave this page in plaintext.
Filename
File Size
Upload Date
Actions
Unlock to load your file list.
Add documents (multiple files are uploaded sequentially; existing files are kept):
Working…
Decrypt a local .vault file:
Offline emergency export / import of the encrypted blob (no plaintext):
Step 3 · Emergency Only
3. Emergency Account Recovery
Lost your passphrase? Generate a new passphrase above, then click 'Reset Vault' to wipe local memory and re-register your Account ID with a fresh master verifier.
Self-Test
Runs verification in the browser console (F12): keyboard hardening plus a Phase 5 end-to-end cycle (passphrase → verifier → register → encrypt → upload → download → decrypt).
Emergency Recovery Card
Print this, cut it to card size, and store it somewhere physically safe. This is the only copy — it is not saved anywhere.