$ ssh git@example.com
ChromVoid · sign this request?
ed25519 · git@example.com
[ Allow ] [ Deny ]SSH agent
Ed25519, RSA and ECDSA keys stay in the vault. You approve every signing request. In the macOS desktop app.
SSH agentPassword and file manager without the cloud
There is nowrong password.
Every password derives its own key, and every key points to its own place in storage. If data lives there, it opens; if not, an empty vault opens. No list of vaults, no “wrong password” error.
What this hides and what it doesn’t — threat modelDownload the appNo sign-up, no serverOther platforms
vault unlock
Stretch the password
Argon2id(password, salt) m = 19 MiB · t = 2 · p = 1
key 35a4a398…13f2 time 0.19 s
Derive the chunk name
BLAKE3(key ‖ "catalog:root" ‖ 0)
chunk 2b597477…50ce
Look the chunk up
64 chunks look alike
Found 6 of 64 chunks
Open
Vault opened
5 items- Emailalice@example.com
- Food deliveryalice.p
- Home Wi-Fihome-network
- Airlineloyalty card
- Packing listnote
Vault opened, 5 items
The demo is lighter: here Argon2id uses 19 MiB and a public salt. The app uses 64 MiB on phones and 256 MiB on computers, and hardens the salt with a separate secret from the system keystore.
InsideArgon2idChaCha20-Poly1305BLAKE3Noise
01Under pressure
When someone demands the password.
Set up two passwords. The everyday one opens a lived-in vault: email, deliveries, home Wi‑Fi. The private one opens another. Under pressure, you give the first.
“Unlock your phone.”
What the inspector sees
Password — any wordvacation
Vault opened · 5 items
- Emailalice@example.com
- Food deliveryalice.p
- Home Wi-Fihome-network
- Airlineloyalty card
- Packing listnote
A real vault with real records opens. Not a placeholder, not a “mode”.
Two passwords, two vaults
Each is its own space on disk with its own key. There is no list of vaults anywhere.
What only you know
Password — any wordcoffee
Vault opened · 4 items
- Bankmain account
- Walletrecovery phrase
- Passport.pdf2.4 MB
- SSH · proded25519
Without the password, these are just chunks on disk.
The app never says “wrong password” or asks “is that all?”. Chunks of different vaults look the same on disk.
The usual way
- A typical password manager
- Answers “wrong password” — and so confirms the vault exists.
- Hiding vaults for a trip
- They are removed from the device, and to “is that everything?” you have to lie.
- A hidden encrypted disk volume
- The same idea, but not a password manager for every day.
- ChromVoid
- Any password opens some vault. What you show is real.
02What everyone else sees
To everyone else, void.
Without the key, the vault is 16 KiB chunks of ciphertext named by hashes. That is all anyone but you can see.
What everyone else seeschunk 540e01…3f · 16 KiB
Move the pointer over the wallDrag a finger across the wall
- Disk
- ChaCha20-Poly1305 chunks of 16 KiB, named by BLAKE3 of the key
- Backup
- an encrypted file you keep
- Relay between your devices
- sealed Noise envelopes: it sees that a connection exists, not what is in it
- Our server
- there is none: no account, no copy of the vault
03Every day
The rest of the time, it is just a password manager.
Everything you expect from a good password manager, without a cloud account.
Passwords and codes
Login, password and one-time code in one item; a password generator.
Autofill
System autofill on iPhone, Android and Mac. In the browser, an extension that keeps no copy of its own and works only while the vault is open.
Files and notes
Documents, photos and notes open inside the vault: viewer, player, Markdown editor. Need a regular folder? Mounted Vault on Mac.
Moving in, and backups
Import from .1pux, .kdbx and .csv. A backup is an encrypted file you keep.
Screens from the pre-release iPhone app, demo data.
04For the terminal
Keys that never leave the vault.
SSH keys and connections live next to your passwords — no plain key files in ~/.ssh.
Noise_XX_25519_ChaChaPoly_BLAKE2s
USB · WebRTC · relayYour phone is the vault
Your computer connects to the vault on your phone over USB or through a relay. The relay sees sealed Noise envelopes. Access is granted with a PIN and can be revoked.
Connect to your phone$ chromvoid env run --profile backend-dev --preset test
waiting for approval…Env Runtime
In development
Secrets for scripts and AI agents: values reach only the process you approved, and the agent never sees them.
05Check it yourself
Don't take our word for it.
Here is what the vault is made of. Every line points to the code.
| Key from password | Argon2id · 64 MiB, 3 passes, 3 lanes on phones · 256 MiB, 4 passes, 4 lanes on computers | crates/core/src/types.rs |
|---|---|---|
| Salt | hardened with a separate 32-byte secret from the system keystore | crates/core/src/crypto/derive_vault_key.rs |
| Encryption | ChaCha20-Poly1305 in 16 KiB chunks, the chunk name as associated data (AAD) | crates/core/src/crypto/chacha.rs |
| Chunk names | BLAKE3(key ‖ context ‖ index), different for every password | crates/core/src/crypto/blake3.rs |
| Device link | Noise_XX_25519_ChaChaPoly_BLAKE2s | crates/protocol/src/noise.rs |
$ shasum -a 256 ChromVoid_*.dmg# compare with the sum on the release page06FAQ
Questions and answers.
When ChromVoid is not the right fit
If you need shared team vaults, seamless sync across every device, or password recovery by support, the ChromVoid model will get in your way rather than help. A backup is a file you keep yourself. Hardware FIDO keys are not supported yet; Windows and Linux builds are planned.
Read the threat modelWhat if they demand a second password?
ChromVoid offers no way to check whether other vaults exist: no list, no error. But someone who knows about the feature can keep demanding, and encryption cannot change that. That is why the vault you show should be lived-in, and the decision stays with you. Details are in the threat model.
Read the threat modelDo I need a cloud account?
No. The vault works without signing up: there is no ChromVoid account, and your data stays on your device.
Can I move my passwords from another manager?
Yes. The app accepts 1Password exports (.1pux), KeePass databases (.kdbx) and the CSV or JSON files that Bitwarden, Chrome and most other managers produce. The import runs on your device.
How do I back up, and what if I lose my device?
A backup is an encrypted file you keep yourself: on a drive, a USB stick or any cloud. The medium only ever holds ciphertext. Without a usable copy and the vault password, recovery is impossible, and we cannot do it for you.
Recommendations in the threat modelDoes every platform have every feature?
No. Available builds are listed in the download section. Modules depend on the platform, OS integrations and app version; each module’s description says where it works.
For the terminal07Download
Try it on your own device.
Choose the app for your device. Create a vault. Keep what matters.
No sign-up: the vault is created on your device
Version, release notes and checksums for direct builds are on the release page. Latest release
Planned: Windows · Linux. Watch releases