Security you can
verify, not just trust.
Guardikey’s design follows one principle: the key stays with you. Everything is encrypted on your own device before it leaves, so even we — and whoever hosts us — only ever see unreadable ciphertext.
Zero-knowledge, by construction
Your data is encrypted locally with a key derived from your master password, which is never transmitted. We store only opaque blobs. We cannot decrypt your vault, reset your master password, or hand your data to anyone — because we never hold the key. If a server were seized tomorrow, there would be nothing readable on it.
Post-quantum from day one
Key exchange uses a hybrid of X25519 and ML-KEM (the NIST-selected post-quantum KEM). An attacker who records your encrypted data today, hoping to break it with a future quantum computer, still faces modern and post-quantum protection at once.
An authenticated cipher cascade
Secrets are protected by layered, standard primitives: Argon2id to turn your password into a key, XChaCha20-Poly1305 to wrap keys, AES-256-GCM for the data, and BLAKE3 keyed fingerprints to catch tampering. Each record is bound to your vault so nothing can be silently swapped.
Your password never leaves your device
Sign-in uses the OPAQUE protocol: you prove you know your password without ever sending it or anything derived from it that a server could brute-force. The server stores a record it can’t reverse, so even a breach never exposes your password.
Local-first — it works offline
Your vault, wallet and messenger run fully on each device. The internet is used only to move encrypted blobs between your phone and computer and to keep your subscription active — never to read your data.
Hardware-key unlock
Add a FIDO2 / WebAuthn security key for a second factor an attacker must physically possess. Biometric unlock keeps day-to-day access fast without weakening the zero-knowledge model.
No obscurity, no backdoors
We rely on Kerckhoffs’s principle: security comes from the key, not from hiding how the system works. We use standard, publicly analysed algorithms, and there is no master key, recovery backdoor, or way for us to see your data — by design, not by promise.
Own your keys
Try the full Pro suite free for 14 days. No account, no card.