Offline · Zero-knowledge

Your vault, readable forever.

This page is a single self-contained file. It contacts no server, runs no analytics, and works without an internet connection. Save it next to your M-DISC backup, hand a copy to your heirs, and your vault stays readable whether or not Henedo is still here.

No network No telemetry Web Crypto + Argon2id

1 · Pick your export bundle (henedo-export-*.zip) 2 · Choose how to unlock

The fastest path. Paste the 32-byte Master Key (MK) you stored offline: either 64 hex characters, or 44 base64 characters. The decryptor uses the MK directly — no Argon2id, no HKDF, no derivation.

Master Key (64 hex chars or 32 bytes base64)

Argon2id runs ~1–2 s on a recent laptop

Waiting for input…

Vault files(0)

Journal(0)

Life Book(0)

Life Story answers(0)

Will / estate(0)

Eternal Vault(0)

The decryption recipe

The crypto used by this page mirrors the production Henedo client byte-for-byte. Anyone with a competent crypto library can re-implement it from this spec.

1. KEK = Argon2id(passphrase + ASK_hex, kdf_salt, m=64MB, t=3, p=4) → HKDF-SHA-256('henedo-kek-v2', 32 bytes) 2. MK = AES-256-GCM.decrypt(KEK, EMK, mk_iv) ─ OR ─ recovery_aes_key = HKDF-SHA-256(recovery_raw, 'henedo-recovery-aes-v1') MK = AES-256-GCM.decrypt(recovery_aes_key, emk_recovery, recovery_iv) ─ OR ─ MK is whatever 32 bytes you stored offline. 3. For each encrypted file in the manifest: FEK = AES-256-GCM.decrypt(MK, EFEK, fek_iv) plaintext = AES-256-GCM.decrypt(FEK, ciphertext, file_iv) 4. File names are decrypted with MK using encrypted_file_name + file_name_iv. 5. Journal entries, Life Book, Life Story answers, and Will payloads are AES-256-GCM ciphertexts encrypted directly under MK. 6. Eternal Vault files: EVAK = AES-256-GCM.decrypt(MK, EEVAK, eevak_iv); manifest = AES-256-GCM.decrypt(EVAK, encrypted_manifest, manifest_iv). The only library dependencies are AES-256-GCM, Argon2id, and HKDF-SHA-256. This page uses Web Crypto for AES-GCM and HKDF, and an inlined Argon2id implementation (hash-wasm) — no network required.

What this page does (and doesn't do)

Runs offline

All crypto is in this file. Open it from a thumb drive, an M-DISC, or your laptop's airplane mode — same result.

No network calls

CSP connect-src 'none'. Your passphrase, ASK, and Master Key never leave this tab.

Audit-ready source

View source. Argon2id, HKDF-SHA-256, AES-256-GCM — every line is right here.

Works in 100 years

As long as a modern browser exists, this bundle is readable. Web Crypto + Argon2id are standard, not Henedo-specific.

Privacy. This file runs entirely in your browser. It does not send your passphrase, ASK, recovery key, Master Key, or any decrypted data to any server. View the page source if you want to verify — it's a single self-contained HTML file.

Long-term archival. Keep a copy of this file alongside your export bundle and your M-DISC. Modern web browsers will continue to read this page for as long as the Web Crypto API and Argon2id remain standard, which is the same shelf-life as the cryptographic primitives themselves.