3.0 QVault
Secrets that stay on your iPhone, each sealed under its own key.
Passwords, notes, codes, and documents that never leave your iPhone. Each item is sealed with ChaCha20-Poly1305 under its own key, derived from your vault key, and a decoy PIN, which never counts as a wrong attempt, opens a separate vault.
The vault lives on one iPhone alone: its items never reach another device, so a lost iPhone is a lost vault.
- RFC 9106 β Argon2id
- RFC 8439 β ChaCha20-Poly1305
- FIPS 203 β ML-KEM-1024
- KDF Argon2id, vault floor m=128 MiB
- AEAD ChaCha20-Poly1305, a key per item
- Key list + relay manifest X25519 + ML-KEM-1024
- Recovery 24 words or k-of-n shares
01 / THE SEAL β IN MOTION
Press seal. Watch the data stop moving.
The rain below is real ciphertext from an authored demo vault. Press [ SEAL ] and every glyph inside the card freezes into its outline.
Every falling glyph is real ciphertext β an authored demo vault sealed with ChaCha20-Poly1305 (RFC 8439) when this page was built. The demo key ships beside the ciphertext on purpose: open it and check.
02 / THE GENERATOR β IN MOTION
Generate a secret. Seal it. Flip one byte and watch Poly1305 refuse.
Drawn from crypto.getRandomValues through rejection sampling β modulo-bias-free, every character uniform over the selected character set.
Nothing leaves this page. Generation, seal, and decrypt run in your browser.
Real ChaCha20-Poly1305 (RFC 8439), compiled from Rust to WebAssembly, running in your browser. Same primitive family as the QERYX protocol; demo build, not the crypto-core module itself.
03 / THE VAULT β LETTERED
Read the vault, section by section.
The key
A vault starts from a key of 32 bytes drawn at random on your iPhone, so nothing you type derives it. The PIN you choose, 6 to 8 digits, opens only the envelope the key sits in: that envelope's own key is derived from your PIN through Argon2id (RFC 9106), which the calibrator sets for your phone at the vault floor of 128 MiB and three passes or more, with four lanes, so each guess costs an adversary at least that much memory-time.1 Inside the envelope, your iPhone's Secure Enclave seals the vault key again: under a key that answers to this iPhone alone until your 24 words are verified, and after that, on an iPhone with a face enrolled, under one that answers only to your face. Someone who copies your iPhone's storage can test PINs against the envelope, but a right guess yields only the vault key still sealed by the Secure Enclave, whose key never leaves this iPhone. Where the Secure Enclave refuses the key, as it may on an iPhone with no face enrolled, the vault falls back to a software envelope, and a copy of the phone's storage is then only as strong as your PIN; the page that confirms the seal names the custody your vault took wherever it can tell.
The seal
Each item seals under ChaCha20-Poly1305 with a key of its own, derived from your vault key and the item's id, so an item moved into another's place does not open. The vault's key list, and the manifest it sends the relay when you sync, are sealed under the X25519 + ML-KEM-1024 hybrid. That layer's own keys are kept under your vault key, so what it guards on the way out is the manifest you sync, not the account password sync also sends, and it adds nothing against someone who already holds the vault key.
- AEAD
- ChaCha20-Poly1305 (RFC 8439), one key per item
- Item keys
- HKDF-SHA256 from your vault key and the item's id
- Key list and relay manifest
- X25519 + ML-KEM-1024 (FIPS 203) hybrid, its keys kept under the vault key
The doors
On this iPhone the vault opens with your PIN and your face together (your fingerprint, on an iPhone with Touch ID): wherever a face is enrolled and Face ID is on for QERYX, every PIN unlock at the vault's pad asks for your face once, before the PIN is checked or counted. On an iPhone with no face enrolled, the PIN door is your PIN and this iPhone, with no Face ID sheet. With Face ID turned off for QERYX, the PIN door asks for no face either, so until your 24 words are verified it is your PIN and this iPhone; verifying them binds it to your face all the same, as below, and from then on it refuses every PIN, a decoy or distress PIN included, until Face ID is on for QERYX again, while your words still open the vault. Your 24 words, or a quorum of their shares, also open the vault, and then you set a new PIN. Wrong PINs are counted before each answer comes back, so closing the app cannot take one back. After the number you choose, from 2 to 10, the vault erases itself; with that setting off, it erases after 25 wrong PINs in a row. Your words, your shares and a distress PIN never count.
A vault QSeal sets up for you takes your QSeal password as its PIN, until you set a new PIN at the vault or set QSeal up again on another password, and QSeal's sign-in opens the vault with it; where the vault's pad cannot type that password, the PIN opens the vault only there. QSeal checks the password itself first, on its own count of misses, apart from the vault's, and with no face, so a wrong password is refused with no Face ID sheet; only a password QSeal accepts reaches the vault, whose door then asks for your face, as at its pad, before it judges the password.
The vault binds the PIN door to your face only once your 24 words are verified. Until then, and whenever it is sealed on an iPhone with no face enrolled, the door rests on a key in this iPhone's Secure Enclave that opens without a face, so a Face ID change cannot close it. Where a face is enrolled, verifying your words binds the door to it, at once or at a later PIN unlock, and from then on a Face ID change (re-enrolling your face, adding an appearance or removing every face) closes the PIN door until your 24 words open the vault and you set a new PIN. Travel Mode, which turns on only after you type three of your 24 words, deletes the PIN door from this iPhone and locks the vault. In both cases, until your words or shares open the vault and you set a new PIN, no PIN opens it, and a decoy or distress PIN typed at the vault does nothing. Travel Mode does not hide the vault.
The decoy
A decoy PIN opens a second vault: separate, populated, and never counted as a wrong attempt. The decoy holds no key to the real vault, and the app never shows the real one while the decoy is open. Items you mark for a curated decoy are copied into it, attachments left out, guarded only by the decoy PIN, which then takes 8 digits; someone with a copy of the phone can still guess it.
Believable is the honest word. We claim the separation we built, never an invisibility we cannot prove: a forensic copy of the phone still shows that a second vault exists.
The recovery
Recovery is 24 words made on this iPhone. Setting up a vault in the QVault tab shows them to you and asks you to type three of them back from your copy. A vault QSeal sets up for you has its words from the start, but QSeal never shows them: Seed Custody, in Cold Seal, shows them and lets you type three of them back. You can split the words into k-of-n shares for people you choose. The words, or a quorum of their shares, reopen the vault on this iPhone if you forget your PIN, if a Face ID change closes the PIN door, or after Travel Mode, and they keep working after you use them. They cannot bring the vault back on another phone or after a wipe. There is no email reset and no key escrow: lose every door, or the iPhone itself, and the vault stays sealed. We state this plainly because it is the design.
The relay
Your items never leave the iPhone. Relay sync is off until you turn it on; then it sends one sealed, padded manifest signed with ML-DSA-87, so a relay that rolls it back or swaps it raises the vault's tamper alarm. Each time you tap SYNC it also sends your account password, to sign in. The relay learns your account, when you synced and a padded size; never an item, a title or a web address.
Your items never leave this iPhone. Neither does the key that opens them.
Coercion has a design answer
Enter the decoy PIN and a full, believable vault opens, and nothing is counted against you. The decoy holds no key to the vault that matters, for as long as it stays open.
You choose what the decoy holds. It is not the real vault's twin: at the pad it meets the same Face ID check as your real PIN, but its key derives from its own PIN alone, it has no post-quantum layer, and a forensic copy of the phone shows that it exists. Armed for SCORCH instead, the decoy PIN erases the real vault and every key it holds, then opens a fresh one.
04 / THE NUMBERS β FOOTNOTED
Check every number against its receipt.
β₯128 MiB1
memory each guess at your PIN costs an attacker β calibrated upward on your iPhone
β₯6Γ2
the OWASP recommended Argon2id memory floor, at the vault floor
03
vault items the iPhone app sends the relay β they stay on the iPhone
| Parameter | Value | Source |
|---|---|---|
| Vault key | 32 random bytes, drawn on the iPhone for each new vault | this iPhone only |
| KDF | Argon2id Β· calibrated, vault floor m=128 MiB Β· t=3 Β· p=4 | RFC 9106 |
| AEAD | ChaCha20-Poly1305, one key per item | RFC 8439 |
| Key list and relay manifest | X25519 + ML-KEM-1024 hybrid, its keys kept under the vault key | FIPS 203 |
| Recovery | 24 words, or k-of-n shares of them | this iPhone only, no escrow |
| Relay sync | off until you turn it on; one sealed, padded manifest, ML-DSA-87-signed | FIPS 204 |
05 / THE COUPLINGS β ONE CORE
Trace where the vault touches the rest of the stack.
What the vault shares, and with what
- QMAIL · ONE ECOSYSTEM β Mail is in development. The vault opens on the phone, by its own doors, and signs in to the relay only when you tap SYNC.
- CRYPTO-CORE · ONE RUST CORE β The source-published Rust core beneath the messenger runs the Argon2id that turns your PIN into the key of the vault's envelope, and signs the vault's relay manifest with ML-DSA-87.
- Q-RATCHET · ONE HYBRID KEM β The vault's key list and relay manifest are sealed with the same X25519 + ML-KEM-1024 hybrid that keys the messenger's handshake.
06 / THE VERDICT β CATEGORY COLUMNS
Set the vault against a password manager and a browser.
| QERYX | Classical password manager | Browser storage | |
|---|---|---|---|
| Real workloads | |||
| Server breached | Nothing from inside your items: they never reach the relay | Vault blobs; weaker KDF settings are common | Plaintext or OS-keychain export |
| Coerced unlock | Decoy PIN, never counted as a wrong attempt | Not included | Not included |
| Quantum recording today | Items never cross the network; the relay manifest is ML-KEM-1024 sealed | classical-only wrap classical-only wrap | Not included |
| Lost PIN | Your 24 words reopen it on this iPhone; without them it stays sealed, and we say so | Account reset weakens the model | Synced to an identity account |
| Cross-device sync | None: the vault stays on this iPhone | Provider-readable metadata is common | Provider plaintext |
07 / THE HARD QUESTIONS
Ask what happens when you forget the PIN.
Can QERYX open my vault?
No. Your vault key is drawn at random on your iPhone; it never leaves the iPhone, and the relay never receives your items. If you sync, it holds a sealed manifest it cannot open.
What if I forget my PIN?
Your 24 words, or a quorum of their shares, reopen the vault on this iPhone and let you set a new PIN; your attachments and the words themselves keep working. Without them the vault stays sealed. There is no key escrow and no master reset. We cannot soften this and stay honest.
What opens my vault, and what does a copy of my iPhone give away?
On this iPhone: your PIN and your face together, the face asked first, wherever a face is enrolled and Face ID is on for QERYX; your PIN and this iPhone on an iPhone with no face enrolled, or, with Face ID turned off for QERYX, at the PIN door until your words are verified; or your 24 words, or a quorum of their shares. For a vault QSeal sets up for you, that PIN is your QSeal password, until you set a new PIN at the vault or set QSeal up again on another password, and QSeal's sign-in opens the vault with it: QSeal checks the password first, with no face and on its own count of misses, so a wrong one is refused with no Face ID sheet, and only one QSeal accepts reaches the vault's door, which asks for your face as at its pad before it judges the password. The weakest of those is the one to judge the vault by, and we state all of them.
Off the phone, against someone who copies its storage, a vault holds a random key, so a guessed PIN yields only that key still sealed by this iPhone's Secure Enclave; where the Secure Enclave refused the key, it is as strong as your PIN.
What can be handed over under subpoena?
From the relay, and only if you synced: your account, when you synced, a sealed, padded manifest and its public signing key; no item. Everything else sits on your iPhone, where the protection is the doors above and, against a copy of its storage, this iPhone's Secure Enclave, and only your PIN wherever the Enclave refused the key.
What does the decoy vault do?
A decoy PIN opens a believable second vault and never counts as a wrong attempt. The decoy holds no key to the real vault, and the app never shows the real one while the decoy is open. You decide what the decoy holds. It raises the cost of coercion; a forensic copy of the phone still shows that a second vault exists.
Why at least 128 MiB of memory for one unlock?
Because every guess at the secret that opens the vault must pay it: each guess at your PIN costs at least 128 MiB of memory across three passes (the vault floor, Argon2id m=128 MiB, t=3, p=4, calibrated upward on your iPhone). Your phone pays that once per unlock; an attacker pays it again for every candidate. A right PIN still yields only a key the Secure Enclave seals, unless the Enclave refused the key.