Relicsoft Vault

Not ready for real credentials.

The cryptographic core is built and tested. The application around it is not. This page is here so the domain, the certificate and the security headers are live and can be checked before anything is trusted to them.

Built

Key hierarchy: Argon2id (256 MiB, 4 passes) over master password + Secret Key, split by HKDF into an auth key and a wrap key.
Item encryption: AES-256-GCM with per-item data keys, every envelope bound to its account and item ID.
Recovery format: 128-bit Secret Key in Crockford base32, built to survive being retyped off a printed sheet.
Tests: 10 passing, including the negative cases — tampering, relocated records, and wrong-key derivation.

Before it opens

WebAuthn passkey unlock
Recovery kit PDF, generated client-side
Supabase schema and row-level security
Server-side hashing of the auth key, with rate limiting
Independent review of the crypto

The threat model, including the limits this design cannot cover, is in SECURITY.md in the repository. Read the second section first — it is the one that matters.