Decentralized Security. Zero Compromises.
We are building VaultKeepR to eliminate the single points of failure in modern identity: centralized database honeypots, master password vulnerabilities, and forced email registrations.
Why We Built VaultKeepR
Traditional password managers force users to trust centralized cloud architectures. When central databases are breached, encrypted vaults containing millions of user credentials are exposed to offline brute-force attacks.
VaultKeepR replaces central cloud servers with mathematical guarantees: client-side XChaCha20-Poly1305 encryption, memory-hard Argon2id key derivation, decentralized IPFS peer-to-peer synchronization, and threshold Shamir Secret Sharing recovery.
Core Pillars & Cryptography
100% Zero-Knowledge
All cryptographic keys are derived strictly in local device memory. Plaintext passwords never touch network interfaces or storage disks unencrypted.
Decentralized Storage (IPFS)
Encrypted ciphertext blobs are addressed content-addressed on IPFS and synchronized using Automerge CRDTs, eliminating centralized database targets.
No Email, No Tracking
Authentication via WebAuthn biometric passkeys and Account Abstraction (ERC-4337). No email verification, phone numbers, or analytics profiling.
Shamir Fragmented Recovery
Recovery keys are split into 5 encrypted fragments requiring any 3-of-5 threshold to reconstruct, removing the vulnerability of central password resets.
Our Mission
The average person now manages dozens of online accounts, and the industry's answer has been to centralize all of those secrets behind one more login. We believe that model is broken. Every centralized vault is a honeypot whose value grows with each user it attracts, and a decade of industry breaches has confirmed the same lesson: data we hold can be stolen; data only you hold cannot.
Our mission is to make zero-knowledge architecture the default rather than the premium option. VaultKeepR is free, open-source, and requires no email address, no phone number, and no personal data of any kind. Your identity on the network is a cryptographic key pair, not a marketing profile.
We also believe privacy tools should be verifiable, not merely promised. That is why every cryptographic primitive we ship lives in public repositories under the MIT license, and why our coordinated disclosure program rewards independent scrutiny instead of discouraging it.
Standards We Build Against
VaultKeepR does not invent cryptography. Every layer of the product maps to a published, peer-reviewed specification:
- Argon2id (RFC 9106) — memory-hard key derivation, the password-hashing recommendation also cited by the OWASP Password Storage Cheat Sheet.
- XChaCha20-Poly1305 — ChaCha20-Poly1305 (RFC 8439) with the extended-nonce construction adopted by libsodium, WireGuard, and Signal.
- WebAuthn Level 2 (W3C Recommendation) — phishing-resistant biometric authentication with hardware-bound credentials.
- Account Abstraction (ERC-4337) — smart accounts enabling keyless, gasless onboarding on Ethereum L2.
- NIST SP 800-63B — where the Digital Identity Guidelines discourage SMS recovery and security questions, VaultKeepR goes further: there is no recovery path that bypasses your Shamir fragments.
Transparency & Open Source
Everything critical to trust is public: the core cryptography packages, the sync protocol built on Automerge CRDTs, and the client applications themselves. You can read exactly how keys are derived, how vaults are serialized and encrypted, and what — if anything — ever leaves your device.
We publish a changelog for every release, coordinate vulnerability disclosure through our security page, and run a bug bounty for qualifying reports. Independent review is welcome; repeated independent review is the only path to earned trust.
Engineering & Security Team
VaultKeepR is founded and led by Justin Lacroix (Founder & CEO), built in the open with an international community of security researchers, distributed-systems engineers, and open-source contributors with backgrounds in applied cryptography, WebAuthn standards, and peer-to-peer protocols. The roadmap is public, the discussions are public, and the code is public.