Key Vault

Your post‑quantum keys, encrypted and stored securely in your browser.

How the key vault works

  1. Create the vault with a master passphrase

    Your browser generates your keys: ML-KEM-768 to receive secrets and ML-DSA-65 to sign them. The private keys never leave the vault.

  2. Everything stays encrypted in your browser

    Keys are stored sealed with AES-256-GCM on an isolated origin (vault.notrust.now) that the main page cannot read. The master passphrase is strengthened with PBKDF2-SHA-256 and 600,000 iterations.

  3. Download the backup

    It is the only way to get your keys back in another browser or after clearing the site's data. It opens with the same master passphrase.

  4. Add and verify contacts

    Keep the public keys of the people you want to send secrets to, and compare their fingerprints over another channel before marking them as verified.

Key vault FAQ

Do my private keys ever leave my device?
No. They are generated and used inside the vault, in your browser; the server never receives them. The only thing you share is your public keys.
What if I forget the master passphrase?
There is no recovery: we store neither the passphrase nor the keys, and the backup opens with it too. Keep it in a password manager.
When does the vault lock?
When you lock it, or after 10 minutes without activity. It unlocks with the master passphrase or with a registered passkey.
Why verify a contact's fingerprint?
The fingerprint summarises their public keys. If it matches the one that person tells you in person or by phone, you know nobody has swapped their keys for an impostor's.
Can I use the same vault on several devices?
Yes: download the backup on one and import it on the other. Each browser keeps its own vault; they do not sync on their own.