3.0 QVault
Secrets sealed under Argon2id and hybrid-wrapped ChaCha20-Poly1305.
Passwords, keys, and documents sealed under Argon2id key derivation and hybrid-wrapped ChaCha20-Poly1305, with a decoy vault cryptographically isolated from the real one.
- RFC 9106 — Argon2id
- RFC 8439 — ChaCha20-Poly1305
- FIPS 203 — ML-KEM-1024
- KDF Argon2id m=512 MiB
- AEAD ChaCha20-Poly1305
- Entry wrap X25519 + ML-KEM-1024
- Recovery SSKR
01 / THE SEAL — LIVE
Press seal. Watch the data stop moving.
The rain below is real ciphertext from an authored demo vault. Press [ SEAL ] and every glyph inside the card freezes into its outline.
Every falling glyph is real ciphertext — an authored demo vault sealed with ChaCha20-Poly1305 (RFC 8439) when this page was built. The demo key ships beside the ciphertext on purpose: open it and check.
02 / THE GENERATOR — LIVE
Generate a secret. Seal it. Flip one byte and watch Poly1305 refuse.
Drawn from crypto.getRandomValues through rejection sampling — modulo-bias-free, every character uniform over the 83-character set.
Nothing leaves this page. Generation, seal, and decrypt run in your browser.
Real ChaCha20-Poly1305 (RFC 8439), compiled from Rust to WebAssembly, running in your browser. Same primitive family as the QERYX protocol; demo build, not the shipped crypto-core module.
03 / THE VAULT — LETTERED
Read the vault, section by section.
The unlock
Your passphrase becomes the vault key on your device, through Argon2id at RFC 9106 spec parameters. Each guess costs an adversary 512 MiB of RAM-time1 — memory-hardness prices GPU and ASIC farms out of the attack.
The seal
Every entry seals under ChaCha20-Poly1305, its key hybrid-wrapped so that X25519 and ML-KEM-1024 must both fall before a sealed blob opens — a recording made today stays sealed against a quantum machine tomorrow.
- AEAD
- ChaCha20-Poly1305 (RFC 8439)
- Wrap
- X25519 + ML-KEM-1024 (FIPS 203) hybrid
- Key source
- your Argon2id-derived key, on device
The decoy
A duress PIN opens a second vault — separate, populated, believable. Once duress fires, the real vault is cryptographically out of reach: the decoy holds no path back to it.
Believable is the honest word. We claim the isolation we shipped, never an invisibility we cannot prove.
The recovery
Recovery is share-based: SSKR splits a recovery secret across people you choose, and a quorum of them restores it. There is no email reset, no key-escrow, and no master reset — lose the passphrase and the shares, and the vault stays sealed. We state this plainly because it is the design.
The sync
Devices exchange sealed blobs through the relay. The server cannot read entry names, URLs, or counts — it stores ciphertext under opaque identifiers, and cross-device trust anchors in KTS.
Your passphrase never leaves the device. Neither does the key it becomes.
Coercion has a design answer
Enter the duress PIN and a full, believable vault opens — entries, history, the works. The vault that matters stays cryptographically out of reach for the rest of the session and beyond.
You choose what the decoy holds. It is a real vault in every way except one: it answers to a different key.
04 / THE NUMBERS — FOOTNOTED
Check every number against its receipt.
512 MiB1
memory each unlock attempt costs an attacker
27×2
the OWASP recommended Argon2id memory floor
03
plaintext entries the server has ever stored
| Parameter | Value | Source |
|---|---|---|
| KDF | Argon2id · m=512 MiB · t=2 · p=4 | RFC 9106 |
| AEAD | ChaCha20-Poly1305 | RFC 8439 |
| Entry wrap | X25519 + ML-KEM-1024 hybrid | FIPS 203 |
| Recovery | SSKR share quorum | no escrow, no master reset |
| Sync | sealed blobs, opaque identifiers | carrier model |
05 / THE COUPLINGS — ONE CORE
Trace where the vault touches the rest of the stack.
What the vault shares, and with what
- QMAIL · ONE SYSTEM ID — Your SYSTEM ID signs you into Mail and Vault; the ecosystem login lives there and nowhere else.
- CRYPTO-CORE · ONE RUST CORE — The same audited core seals your vault and your messages: one implementation beneath every platform.
- Q-RATCHET · ONE KEY DISCIPLINE — The messenger rides the same hybrid agreement your vault entries are wrapped with. Nothing in the ecosystem falls back to classical-only.
06 / THE VERDICT — CATEGORY COLUMNS
Set the vault against a password manager and a browser.
| QERYX | Classical password manager | Browser storage | |
|---|---|---|---|
| Real workloads | |||
| Server breached | Sealed blobs: 512-MiB Argon2id + hybrid wrap | Vault blobs; weaker KDF settings are common | Plaintext or OS-keychain export |
| Coerced unlock | Decoy vault path | Not included | Not included |
| Quantum recording today | ML-KEM-1024 wrapped | classical-only wrap classical-only wrap | Not included |
| Lost passphrase | SSKR social recovery — else gone, and we say so | Account reset weakens the model | Synced to an identity account |
| Cross-device sync | Sealed blobs the relay cannot read | Provider-readable metadata is common | Provider plaintext |
07 / ACCESS — WITH ARMED
Take the vault with the Armed tier.
What unlocks it?
QVault ships inside the Armed tier, everything unlimited. Nothing is purchasable in this build: the app carries no checkout surface and no price. When a subscription opens it funds the vault — no ads and no data sales anywhere in the model. Tiers add tools; they never upgrade the crypto you already have.
How do I start?
Get QERYX, choose a passphrase, and your vault key derives on the first unlock — on your device, through Argon2id. Nothing about your vault is created server-side, so there is nothing server-side to take.
08 / THE HARD QUESTIONS
Ask what happens when you lose the passphrase.
Can QERYX open my vault?
No. The vault key derives from your passphrase through Argon2id on your device; the server stores sealed blobs it cannot read.
What if I forget my passphrase?
SSKR social recovery restores it, if you set shares up. Otherwise the vault is unrecoverable — there is no key-escrow and no master reset. We cannot soften this and stay honest.
What can be handed over under subpoena?
Sealed blobs. Opening them requires your passphrase-derived key — breaking Argon2id at 512 MiB, then the hybrid X25519 + ML-KEM-1024 wrap on top.
What does the decoy vault do?
A duress PIN opens a believable second vault while the real one stays cryptographically out of reach. You decide what the decoy holds.
Why 512 MiB of memory for one unlock?
Memory-hardness prices out GPU and ASIC guessing: each attempt costs half a gigabyte of RAM-time (Argon2id, m=512 MiB, t=2, p=4). Your phone pays that once per unlock; an attacker pays it again for every candidate passphrase.
Why no free tier?
The vault is part of Armed. Nothing is purchasable in this build; when the tier opens, a subscription funds it — never ads, never data sales. That keeps the incentives pointed at you.