Skip to main content

The vault & password manager

Two places to keep secrets, both built on the same principle: the server never sees your plaintext. One stores sealed blobs you can retrieve from anywhere; the other derives passwords on the fly and stores nothing at all.

ZeqVault — zero-knowledge storage​

The ZeqVault stores your secrets encrypted-at-rest — but the important part is where the encryption happens. A blob is sealed with HITE (AES-256-GCM under a PIN you choose) in your browser, before it's sent. The server stores an opaque blob and a label; it cannot decrypt it, because it never has your PIN. Retrieve an entry and it comes back still sealed — only your PIN, on your device, opens it.

POST   /api/zeq-vault/save     { label, zeq_blob }   # blob already sealed client-side
GET    /api/zeq-vault/list                            # labels only — never the blobs
GET    /api/zeq-vault/:id                             # fetch one sealed blob
DELETE /api/zeq-vault/:id                             # remove it

The list endpoint returns labels only, never the sealed blobs — so even the index of what you keep reveals nothing about its contents. It's defence in depth: sealed before it leaves you, opaque at rest, and openable only by you.

ZeqPM — passwords with nothing to steal​

ZeqPM is a password manager with an unusual property: it stores nothing. Instead of keeping a database of your passwords, it derives them, in your browser, from your words plus the current Zeqond — and the same words produce a different result each moment, because the clock is part of the seed. You save the output, not the words, and nothing is ever sent anywhere.

Derived, not stored

Passwords and login equations are generated in the browser from your words and the Zeqond — there's no vault of secrets to breach.

Clock-seeded

The 1.287 Hz Zeqond is part of the seed, so the same words yield a fresh, strong output at each tick.

Nothing leaves the page

Generation is entirely client-side. No request carries your words or the result off your device.

Together with your identity​

Both fit the framework's identity model: your account is an equation, your recovery is a .ZEQ file you hold, and now your other secrets are either sealed under your own PIN (ZeqVault) or never stored at all (ZeqPM). At no point does the framework hold a key that could open your data — that's the whole design.