LegacyVault encrypts your passwords, keys and documents on your own device.
A dead man's switch hands them to your chosen beneficiaries — but only after
you stop checking in, and only with the physical key they hold.
🔐
Encrypted on your deviceAES-256-GCM under a key only you can derive. The server never sees your password and can never decrypt alone.
🧩
2-of-3 shardsYour vault key is split into three shards: this device, the server, and a paper shard you print. Any two reconstruct it; one leaks nothing.
⏳
Dead man's switchCheck in to stay alive. Miss your timer and the server releases your key's server shard to your beneficiaries.
How the handover works
You create a vault with a master password. Your key is derived locally with PBKDF2-SHA256 (310,000 rounds) and never leaves this browser.
The key is split into 3 Shamir shards (2-of-3): Shard A stays on this device, Shard B goes to the server, Shard C is printed and given to your beneficiary.
Each secret is encrypted with AES-256-GCM before anything is stored or synced. Only ciphertext ever reaches the server.
If you miss your check-ins, the server releases Shard B to your beneficiary through a single-use link. Your beneficiary combines it with the physical Shard C they hold, reconstructs the key, and decrypts the vault — the server alone still can't.
Create your vault
Already have a vault?
If you created a vault in this browser before, unlock it with your
master password.
Are you a beneficiary?
Received a release email after someone's timer ran out? Go to the
Recovery center — you only need the link and the paper shard they
gave you. No account required.
This MVP runs…
Detecting storage mode…
Unlock your vault
Loading…
🔑Forgot your password? LegacyVault cannot reset it — that's the point. Recover the vault with your paper Shard C plus a released server shard (or the device shard) via the Recovery center.
Dead man's switch
Shard health — 2 of 3
Demo mailbox — release emails the local server would have sent (demo only)
Secrets
Simulation controls — preview the handover without waiting 30 days
Your session
Locking keeps your vault on disk but removes the key from memory.
Erasing removes the device profile, the server-side vault copy and every
shard this demo can reach — do it only when you want a clean start.
Recovery center
Unlock a released legacy
If someone released their vault to you, paste the link from their email.
You will combine the server shard with the paper shard they gave you.
1 · Link
2 · Paper shard
3 · Decrypt
4 · Done
Step 1 — Paste your recovery link
Step 2 — Enter your paper shard (Shard C)
Step 3 — Combine & decrypt
🕶️You're decrypting on this device. On a shared or borrowed computer, close the tab afterwards — anything revealed here is visible to whoever uses this screen next.
Owner drill — prove the math
Unlocked your own vault and want proof the shard model works? Combine your
paper Shard C with the server's Shard B right here. No release needed.