Your complete password vault — passwords, notes and 2FA secrets — lives encrypted inside an ordinary-looking PNG file. Larger files use separate encrypted containers. Here is what happens during setup and every unlock.
First-time setup takes about two minutes. After that, every time you open BlindLock you wait about ten seconds for the PIN check. It feels slow, and that is the point: if someone later tries to guess your PIN — for example after stealing your device — every wrong attempt costs those same ten seconds. Without that brake, a program could try thousands of PINs in a few minutes. With it, the same attack takes days or weeks and is not worth the effort. The PIN only opens BlindLock on your device. It does not open your vault — that still needs your password and this exact device.
Pick any PNG file on your device. A holiday photo, a screenshot — whatever looks unremarkable in your own filesystem. BlindLock inspects the carrier's capacity and confirms it can hold the payload without visible distortion.
The carrier stays exactly where you put it. There is no "vault folder" created anywhere on disk.
You set your password, and BlindLock anchors non-exportable key material in the device's security hardware — TPM 2.0, Secure Enclave or StrongBox, depending on the platform. You can also set up a hardware key such as a YubiKey, Google Titan or SoloKey.
None of these is enough alone: not the file, not the password, and not the device. Only all three, combined through HKDF, derive the vault key. The same file with the same password yields a mathematically wrong key on any other machine.
Passwords, TOTP seeds and notes are encrypted in memory before being written into the carrier. Larger documents and media go into separate encrypted file-vault containers, so the two storage types remain distinct. The login-stego password vault uses classical 256-bit dual AEAD. File-vault containers use authenticated encryption as documented on the Security page.
BlindLock stores your encrypted password vault invisibly inside the image you chose. Visually nothing changes: before and after, the file looks the same. You cannot tell from looking at the image that data is hidden inside it.
Keep the active carrier safe and back it up deliberately. For migration and emergencies, also create an encrypted BlindLock backup and keep its twelve words separately. If you use file vaults, back up each container together with its recovery file and recovery factor. You may choose local media, an external drive or a cloud-synchronised folder. BlindLock does not operate a central backup service.
Every unlock follows the same local cryptographic path. A brief encrypted connection verifies licence entitlement and version status, but no vault contents are sent. Once unlocked, the vault continues to work locally until the session closes.
┌─────────────────────── carrier.png ───────────────────────┐ │ │ │ ordinary-looking image data │ │ + │ │ concealed, encrypted password vault │ │ ├── passwords and login data │ │ └── notes and TOTP secrets │ │ │ └──── concealment + encryption + hardware binding ─────────┘ large documents and media ──► separate encrypted file-vault containers How the vault opens: PIN ──► entry gate (Argon2id, 256 MiB, ~10 s — not a vault factor) │ unlocks BlindLock’s hardware-sealed app anchor (app path — not native chip PIN policy) ▼ HKDF combines three factors into the vault key: 1) File ── encrypted vault concealed in the carrier 2) Password ── Argon2id, memory-hard (512 MiB–4 GB per device) 3) Device ── non-exportable anchor in security hardware (TPM 2.0 / Secure Enclave / StrongBox) (optional 4th factor: hardware key via FIDO2) │ a wrong device yields a mathematically wrong key ▼ Vault is decrypted — in memory only ▼ vault open in memory ▼ instantly erased the moment you lock
Four places, four different things.
Passwords, notes and 2FA secrets are sealed twice before they ever reach the image: AES-256-GCM and XChaCha20-Poly1305 stacked, with independent keys. Breaking one seal still leaves the other.
The data goes into the pixels themselves, a tiny fraction per pixel — far too little for an eye to catch. The method is called F5 matrix encoding. Its trick: it spreads the data so that out of seven positions it could use, on average only one has to be changed at all. And the less that changes, the less the image differs from an untouched photo — including for the tools built to look for exactly that.
Which positions are used follows from your password. Without it nobody knows where to look. And no marker is left behind: nothing about the file says BlindLock wrote it.
The key to your vault is stored nowhere — not with you, not with us. It is assembled fresh every time you open, from four parts: your carrier file, your password, your computer's security chip, and a fourth part BlindLock fetches from the licence server at that moment. That fourth part is a random number that means nothing on its own. It lives with us, not with you: your machine fetches it fresh every time you open and does not keep it.
If one of the four is missing, there is no error message. There is a key that simply does not fit.
All that reaches us is the question of whether your licence is valid and which version you have installed. What your vault holds, our server never learns — that never leaves your computer.
And if our server is unreachable, that does not lock you out. At your last unlock it gave your device a pass that is good for seven days. For that long BlindLock opens without internet too.
Files live in separate encrypted containers with ChaCha20-Poly1305, opened with your password, hardware-sealed to your computer's security chip. You set how large a container is when you create it.
Honest answers to the awkward cases.
BlindLock cannot reset it — and there is no way around it. The twelve words do not replace your password. It stands in for the device binding and, if enabled, the hardware key. Treat your master password with the same care as the vault itself.
The carrier and password are not enough without the authorised device. Restore your encrypted backup on the new device — with the backup file and the separately stored twelve words. Then sign in with your master password as usual.
As long as you can still sign in on your device, nothing is lost: reveal your twelve words again under Backup and write them down anew. If you would rather retire them, generate twelve new ones there. The old words lose all effect at once, and BlindLock writes you a fresh backup file — the old ones no longer fit.
They have only the file — which is encrypted and bound to your security chip either way. They still lack your password and your device — and, if enabled, your hardware key. Without those factors, none of it can be read.
Cloudless storage, privacy, hardware binding and steganography — then compare honestly.
Open the interactive demo with the real desktop flow — or check Lifetime pricing for later.