🔐 Legacy Vault

🔑 Password-Derived Encryption Key

Your password is never stored anywhere. Instead, it is used to derive a cryptographic key using PBKDF2 with 200,000 iterations of SHA-256 and a unique random salt. This makes brute-force attacks extremely slow and computationally expensive.

🛡️ AES-256-GCM Encryption

All vault data — entries, attachments, and emergency contacts — is encrypted with AES-256-GCM, the same standard used by banks and governments worldwide. A new random initialisation vector (IV) is generated for every save, so no two ciphertexts are alike.

💾 Local Storage Only

Your data never leaves your device. Everything is stored encrypted in your browser's local storage. No server, no cloud sync, no third-party access. Only someone with your password can decrypt it.

🔒 Key Lives Only in Memory

The decryption key exists only in browser memory while you are logged in. When you lock the vault, the key is immediately cleared. Closing the browser tab also destroys the key.

📤 Backup Files

Exported backup files are plain JSON so they can be read by the Legacy Vault iOS app. Store them somewhere secure — a password manager, encrypted drive, or sealed with your access card.