Derived in this browser and never transmitted. The droplet stores sealed bytes and a public salt; it holds no key and cannot read a single record. There is no reset, by design — use Shamir shares for recovery.
Passphrase
Entropy estimate appears as you type.
The hypercube above is a deterministic image of your key. Learn its colouring: a wrong passphrase produces a visibly different cube before anything is decrypted.
Seal a Record
LabelIdentitySecret
Label and identity are sealed in their own AES-GCM envelope, not just the secret. A server that can read your labels learns which services you hold, which is most of the value of the vault.
Commitment
Inclusion Proof
Proving one record belongs takes log₂(n) hashes, not the whole vault. Leaves are hashed with a 0x00 prefix and internal nodes with 0x01, which is what stops an attacker passing an internal node off as a leaf.
idle.
Threshold Recovery
Split the root key into n shares over GF(2⁸) so any k rebuild it and any k−1 reveal nothing. Not "less" — zero. Every possible key stays exactly as likely.
threshold k
shares n
Shares · tap to select
no shares yet
idle.
Shares are shown here and never leave the browser. Write them down, split them across places, and the vault survives a forgotten passphrase.