Encrypted Vault

Hardware-backed keystore. AES-256-GCM. QR sync. Emergency codes. Access policies.

Get Key to Unlock Vault

Architecture

Master Key

  • Generated in Android Keystore (StrongBox when available)
  • 256-bit AES key, never leaves secure hardware
  • Requires biometric auth for every decrypt
  • Invalidated on biometric enrollment change
  • RSA-2048 wrapper for key import/export

Per-Entry Encryption

  • AES-256-GCM with unique 12-byte IV per entry
  • Authenticated encryption (AAD = entry ID + type)
  • PBKDF2 (100k iterations) for passphrase-derived keys
  • Entry structure: {id, name, value, type, meta, IV, tag}

Key Types

DEVICE

Device-bound keys for app authentication. Tied to device ID + package name.

SYNC

Cross-device sync keys. Encrypted with sync passphrase. QR export/import.

EMERGENCY

One-time use, 24h expiry, max-uses policy. For when you lose biometric access.

QR Sync

Device-to-Device Transfer

No cloud, no server. Animated QR codes transfer encrypted vault data directly between devices.

  • Vault exported as encrypted JSON (AES-256-GCM with sync passphrase)
  • Split into multiple QR frames (max 2KB per frame)
  • Animated at 10fps, scanned by receiving device camera
  • Progress indicator, error correction, resume capability
  • Works offline, no network required

Emergency Codes & Access Policies

Emergency Codes

  • Format: ABCD-EFGH-IJKL-MNOP (16 chars, base32)
  • One-time use, 24-hour expiry
  • Configurable max-uses (default 1)
  • Stored encrypted in vault, revealed on demand

Access Policies

  • Require biometric for decrypt
  • Max uses per key (default unlimited)
  • Allowed package names (restrict which apps can decrypt)
  • Expiry date per key