Decentralized Security. Zero Compromises.
We are building VaultKeepR to eliminate the single points of failure in modern identity: centralized database honeypots, master password vulnerabilities, and forced email registrations.
Why We Built VaultKeepR
Traditional password managers force users to trust centralized cloud architectures. When central databases are breached, encrypted vaults containing millions of user credentials are exposed to offline brute-force attacks.
VaultKeepR replaces central cloud servers with mathematical guarantees: client-side XChaCha20-Poly1305 encryption, memory-hard Argon2id key derivation, decentralized IPFS peer-to-peer synchronization, and threshold Shamir Secret Sharing recovery.
Core Pillars & Cryptography
100% Zero-Knowledge
All cryptographic keys are derived strictly in local device memory. Plaintext passwords never touch network interfaces or storage disks unencrypted.
Decentralized Storage (IPFS)
Encrypted ciphertext blobs are addressed content-addressed on IPFS and synchronized using Automerge CRDTs, eliminating centralized database targets.
No Email, No Tracking
Authentication via WebAuthn biometric passkeys and Account Abstraction (ERC-4337). No email verification, phone numbers, or analytics profiling.
Shamir Fragmented Recovery
Recovery keys are split into 5 encrypted fragments requiring any 3-of-5 threshold to reconstruct, removing the vulnerability of central password resets.
Our Mission
The average person now manages dozens of online accounts, and the industry's answer has been to centralize all of those secrets behind one more login. We believe that model is broken. Every centralized vault is a honeypot whose value grows with each user it attracts, and a decade of industry breaches has confirmed the same lesson: data we hold can be stolen; data only you hold cannot.
Our mission is to make zero-knowledge architecture the default rather than the premium option. VaultKeepR is free, has an open-source SDK, and requires no email address, no phone number, and no personal data of any kind. Your identity on the network is a cryptographic key pair, not a marketing profile.
We also believe privacy tools should be verifiable, not merely promised. That is why every cryptographic primitive we ship lives in public repositories under the MIT license, and why our coordinated disclosure program rewards independent scrutiny instead of discouraging it.
Standards We Build Against
VaultKeepR does not invent cryptography. Every layer of the product maps to a published, peer-reviewed specification:
- Argon2id (RFC 9106): memory-hard key derivation, the password-hashing recommendation also cited by the OWASP Password Storage Cheat Sheet.
- XChaCha20-Poly1305: ChaCha20-Poly1305 (RFC 8439) with the extended-nonce construction adopted by libsodium, WireGuard, and Signal.
- WebAuthn Level 2 (W3C Recommendation): phishing-resistant biometric authentication with hardware-bound credentials.
- Account Abstraction (ERC-4337): smart accounts enabling keyless, gasless onboarding on Ethereum L2.
- NIST SP 800-63B: where the Digital Identity Guidelines discourage SMS recovery and security questions, VaultKeepR goes further: there is no recovery path that bypasses your Shamir fragments.
Transparency & Open Source
The SDK core cryptography packages and the sync protocol built on Automerge CRDTs are public. You can read how keys are derived, how vaults are serialized and encrypted, and what, if anything, leaves your device. The client apps (web, browser extension, mobile) are not public: they live in a private repository and link against the public core.
We publish a changelog for every release, coordinate vulnerability disclosure through our security page, and run a bug bounty for qualifying reports. Independent review is welcome; repeated independent review is the only path to earned trust.
Engineering & Security Team
VaultKeepR is founded and led by Justin Lacroix (Founder & CEO), built in the open with an international community of security researchers, distributed-systems engineers, and open-source contributors with backgrounds in applied cryptography, WebAuthn standards, and peer-to-peer protocols. The roadmap is public, the discussions are public, and the cryptography core is public.
Frequently Asked Questions
Why doesn't VaultKeepR require an email address?
VaultKeepR authenticates you with WebAuthn passkeys and on-device cryptography instead of an account. Your identity is a cryptographic key that never leaves your device, so there is no email address to leak, sell, or reset through a support desk.
How can my vault be recovered without a master password?
Recovery uses 3-of-5 Shamir Secret Sharing: the master secret is split into five encrypted fragments stored in different places — your device, IPFS, a trusted guardian, an on-chain timelock, and an encrypted relay. Any three fragments reconstruct the vault; no single party, including VaultKeepR, holds enough to unlock it alone.
What encryption does VaultKeepR use?
XChaCha20-Poly1305 authenticated encryption with Argon2id key derivation (64 MiB memory, 3 iterations, 4 lanes). Keys are derived and used entirely on your device; only ciphertext is ever stored or synchronized.
Is VaultKeepR open source?
Partly. The SDK and smart contracts are open source under MIT. The web, browser extension, and mobile clients are maintained in a private repository. Release artifacts are signed with minisign.