Security
Designed so you don't
have to trust anyone.
What Sealkeep protects, how, and where its protection ends.
Status
Sealkeep has not had an independent security audit. It is built from standard, well-studied primitives, has automated adversarial tests and a recorded security test campaign, and its design is described on this page. It is pre-release software: do not rely on it as the only copy of important files.
Cryptography
- Encryption: XChaCha20-Poly1305 for everything stored in a vault, so every object is both encrypted and authenticated.
- Passwords: Argon2id, 256 MiB of memory and 3 passes by default, so each guess is slow even on special hardware.
- Keys: one random root key per vault, stored only wrapped under your credentials. HKDF-SHA256 and HMAC-SHA256 separate it into keys for each purpose.
- Keyfiles (optional): a 256-bit random file. In keyfile mode the vault cannot be opened without it, enforced by the key derivation itself.
- No back door: no master key, no escrow, no recovery phrase, no reset.
Against a hostile storage provider
Sealkeep assumes the cloud folder may be read, changed, reordered or replayed by someone else.
- Contents, file names, folder structure, timestamps and logical sizes are encrypted.
- Every object is bound to its vault, its file and its position, so swapping, truncating or repeating pieces is detected.
- Rolling a vault back to an older state is detected on devices that have seen a newer one.
Limits
No encryption tool can do everything. Sealkeep cannot:
- Hide how many encrypted objects a vault has, roughly how big they are, or when they change. Your storage provider can see that.
- Stop someone with write access to the folder from deleting it. Keep backups.
- Protect files on a device that is infected with malware while the vault is unlocked.
- Recover a vault if you lose your password, or your keyfile in keyfile mode.
What Sealkeep sends over the network
| What | Where to | When |
|---|---|---|
| Licence key, a random installation id and the app version | The Sealkeep licensing service, which checks the key with Lemon Squeezy | Only when you activate, refresh or deactivate a licence |
Your files, file names, passwords, keyfiles and vault keys never leave your device unencrypted. Your sync service uploads the encrypted vault folder on its own; Sealkeep never connects to it.
Report a vulnerability
Please email security@sealkeep.eu. You can expect an acknowledgement within 5 working days and an initial assessment within 14 days. Disclosure is coordinated, normally within 90 days of the report or when a fix is released, whichever is first. Credit is given if you want it. There is no paid bug bounty. See also security.txt.
Use synthetic data only. Never send real vault files, passwords, keyfiles or licence keys: I will never ask for them, and I couldn’t use them to unlock anything. Forgetting a password is not a vulnerability; Sealkeep has no recovery by design.
This website has no cookies, no analytics, no JavaScript and no third-party requests, and sends a strict Content Security Policy.