KryVault is built so that we cannot read your files — not if we wanted to, and
not if someone forced us to. This page explains how, step by step, in plain
words. Technical details for reviewers are at the end.
The short version: your files are locked on your own device
before they are uploaded. The only thing that can unlock them is your
28-character key, and we never see that key. Our server stores scrambled data
and nothing else about you.
1. Your key is your account
When you create a vault, your browser makes a random 28-character key. It is made on your device, not on our server.
There is no username, email or phone number. The key is the only thing that opens the vault.
The key is shown to you once. We do not store it, or anything that could rebuild it.
There are more possible keys than grains of sand on Earth — by a very long way — so nobody can guess yours.
Letters that are easy to confuse (I, L, O and U) are never used, so the key is easy to read and write down.
2. The key is turned into two separate secrets
Your browser runs the key through Argon2id, a method that is slow and uses a lot
of memory on purpose — it makes guessing keys very expensive for an attacker. It
produces two different values:
A lookup value, used only to find your vault. Our server stores just a one-way fingerprint (hash) of it, so our own database cannot be used to work back to your key.
A root key, which locks and unlocks your files. It never leaves your browser, and even code running on the page cannot copy it out.
3. Every file is locked before it leaves your device
Each file gets its own random key and is encrypted with AES-256, a widely used standard also trusted by banks and governments.
Big files are split into 4 MB pieces. Each piece is locked separately and checked when you open it, so any change or damage is detected.
The file's own key is then locked with your root key.
The file name, file type and folder are encrypted too. Our server does not even know what your files are called.
Notes you write inside the vault are encrypted in exactly the same way.
What our server can and cannot see
We can see
We can never see
Scrambled (encrypted) data
Your files or notes
The size of each file
File names, file types or folder names
When a file was uploaded
Your key
How much space your vault uses
Your name, email or phone number — we never ask
Like any website, our hosting provider sees your IP address when you connect. It
is used only to deliver the page and stop abuse — for example, limiting how many
vaults one network can create — and it cannot be linked to what is inside a
vault, because we cannot read what is inside. See the privacy policy.
4. Opening your vault
You type your key. Your browser rebuilds the two secrets and asks our server to open a session.
The session lasts 15 minutes and renews itself while you use the vault. It is held only in the tab's memory — never in cookies or saved on your device.
Press Lock vault or close the tab, and nothing is left behind.
5. If you lose your key
Your files are gone for good. There is no "forgot key" button, no support team
that can help and no back door. This is not a missing feature — it is the
protection itself. If we could open your vault to help you, we could also be
forced to open it for someone else.
Keep your key safe in at least two places:
a password manager,
a printed copy kept somewhere safe at home, or
the downloaded key file on a pen drive kept offline.
What KryVault does not protect you from
No tool protects against everything. Being honest about the limits:
Anyone who has your key can open your vault. Do not share it or paste it into chats.
A virus or spyware on your phone or computer can see whatever you see on your screen.
KryVault runs in your browser, so you are trusting that the code we send does what this page says. We keep that code small, with no ads and no cookies, so there is less to trust. The only outside script is Cloudflare Web Analytics, a cookie-free visit counter; it is not loaded on the payment page.
Free vaults expire after 90 days, then stay read-only for 30 more days so you can take your files out. Paid plans last as long as you prepay.
Stopping bots without asking who you are
When you create a vault, your browser solves a small puzzle that takes a few
seconds. That is nothing for one person, but it makes creating thousands of
vaults slow and costly for a bot — without us ever asking for a phone number or
email. Vault creation is also limited per network.
Technical details (for reviewers)
Key: 28 characters of Crockford Base32 (140 bits) from crypto.getRandomValues, generated client-side and shown once.
Key derivation: Argon2id (64 MB, t=3, p=1) via hash-wasm, run twice with the salts vault-lookup-v1 and vault-enc-v1. The server stores only SHA-256 of the lookup hash.
Root key: imported as a non-extractable Web Crypto AES-GCM key.
Files: AES-256-GCM via Web Crypto in 4 MB chunks. 96-bit IVs are a 4-byte random prefix followed by an 8-byte big-endian chunk counter; the AAD binds file id, chunk index and total chunk count. Each file has a random key, wrapped with AES-GCM under the root key.
Metadata: file name, MIME type and folder are encrypted with the file key; the server never sees them.
Sessions: 15-minute HS256 JWT kept in memory only — no cookies, no localStorage.
Abuse limits: 20-bit hashcash proof-of-work with an HMAC-signed, 10-minute challenge, plus per-IP rate limits.
Transport and headers: HTTPS with HSTS, a strict Content Security Policy (script-src 'self'; network access only to our own API), Referrer-Policy: no-referrer, no framing.
KryVault
← Back to home