Security you can
verify, not just trust.
Guardikey’s design follows one principle: the key stays with you. Everything is encrypted on your own device before it leaves, so even we — and whoever hosts us — only ever see unreadable ciphertext.
Zero-knowledge, by construction
Your data is encrypted locally with a key derived from your master password, which is never transmitted. We store only opaque blobs. We cannot decrypt your vault, reset your master password, or hand your data to anyone — because we never hold the key. If a server were seized tomorrow, there would be nothing readable on it.
Post-quantum from day one
Key exchange uses a hybrid of X25519 and ML-KEM (the NIST-selected post-quantum KEM). An attacker who records your encrypted data today, hoping to break it with a future quantum computer, still faces modern and post-quantum protection at once.
An authenticated cipher cascade
Secrets are protected by layered, standard primitives: Argon2id to turn your password into a key, XChaCha20-Poly1305 to wrap keys, AES-256-GCM for the data, and BLAKE3 keyed fingerprints to catch tampering. Each record is bound to your vault so nothing can be silently swapped.
Your password never leaves your device
Sign-in uses the OPAQUE protocol: you prove you know your password without ever sending it or anything derived from it that a server could brute-force. The server stores a record it can’t reverse, so even a breach never exposes your password.
Local-first — it works offline
Your vault, wallet and messenger run fully on each device. The internet is used only to move encrypted blobs between your phone and computer and to keep your subscription active — never to read your data.
Hardware-key unlock
Add a FIDO2 / WebAuthn security key for a second factor an attacker must physically possess. Biometric unlock keeps day-to-day access fast without weakening the zero-knowledge model.
No obscurity, no backdoors
We rely on Kerckhoffs’s principle: security comes from the key, not from hiding how the system works. We use standard, publicly analysed algorithms, and there is no master key, recovery backdoor, or way for us to see your data — by design, not by promise.
Layered by design
Not one lock but a cascade — each a standard, publicly analysed primitive, so breaking any single layer is never enough to reach your data. Hover a layer to trace it.
- Argon2idturns your password into keys — memory-hard, 64 MiB
- XChaCha20-Poly1305wraps your keys with 192-bit nonces
- AES-256-GCMencrypts the data itself, authenticated
- X25519 + ML-KEMpost-quantum hybrid key exchange
Trust you can check,
not just take on faith
No claims you can't verify. These are the guarantees and the design choices that mean your data stays yours — the real proof behind the promise.
No backdoors, by design
Standard, publicly analysed algorithms — no secret sauce, no master key, and no way in that we could ever be compelled to use.
Your keys never leave your device
Your master password and seed phrase are used only on your own device and are never transmitted — not even to us.
We can't read your data
If our servers were seized tomorrow, there would be only ciphertext on them. We can't decrypt your vault — and that is the whole point.
Honest guarantees
A 14-day free trial with no card, and a 30-day money-back guarantee on your first charge. Cancel anytime, no questions.
Safe, taxed payments
Paddle is our Merchant of Record: secure checkout, local VAT/GST handled for you, and a clear, recognisable line on your statement.
Built by Apexium Technology
An independent company focused only on privacy-first security tools — not an ad business that quietly monetises your data.
Own your keys
Try the full Pro suite free for 14 days. No account, no card.