Your complete password vault — passwords, notes and 2FA secrets — lives encrypted inside an ordinary-looking PNG file. Larger files use separate disguised, encrypted containers. Here is what happens during setup and every unlock.
First-time setup takes about two minutes. The longest part is the deliberate wait while your PIN is secured: it runs through Argon2id over 256 MiB of memory, calibrated to about 10 seconds per check. The PIN is an app entry gate for BlindLock’s hardware-sealed app anchor — not the chip’s native auth policy and not the vault key itself. That intentional delay is what makes later guessing costly.
Pick any PNG file on your device. A holiday photo, a screenshot — whatever looks unremarkable in your own filesystem. BlindLock inspects the carrier's capacity and confirms it can hold the payload without visible distortion.
The carrier stays exactly where you put it. There is no "vault folder" created anywhere on disk.
You set your password, and BlindLock anchors non-exportable key material in the device's security hardware — TPM 2.0, Secure Enclave or StrongBox, depending on the platform. You can also require a security key such as a YubiKey, Google Titan or SoloKey.
None of these is enough alone: not the file, not the password, and not the device. Only all three, combined through HKDF, derive the vault key. The same file with the same password yields a mathematically wrong key on any other machine.
Passwords, TOTP seeds and notes are encrypted in memory before being written into the carrier. Larger documents and media go into separate disguised file-vault containers, so the two storage types remain clear. The login-stego password vault uses classical 256-bit dual AEAD; file-vault containers use authenticated encryption as documented on the Security page.
BlindLock conceals the complete encrypted password vault in the carrier using steganography — the practice of hiding information inside an ordinary-looking file. The PNG still looks like an everyday image. A copied carrier alone is not enough to gain access.
Keep the active carrier safe and back it up deliberately. For migration and emergencies, also create an encrypted BlindLock backup and keep its recovery phrase separately. If you use file vaults, back up each container together with its recovery file and recovery factor. You may choose local media, an external drive or a cloud-synchronised folder; BlindLock does not operate a central backup service.
Every unlock follows the same local cryptographic path. A brief encrypted connection verifies licence entitlement and version status, but no vault contents are sent. Once unlocked, the vault continues to work locally until the session closes.
┌─────────────────────── carrier.png ───────────────────────┐ │ │ │ ordinary-looking image data │ │ + │ │ concealed, encrypted password vault │ │ ├── passwords and login data │ │ └── notes and TOTP secrets │ │ │ └──── concealment + encryption + hardware binding ─────────┘ large documents and media ──► separate disguised, encrypted file-vault containers How the vault opens: PIN ──► entry gate (Argon2id, 256 MiB, ~10 s; not a vault factor) │ unlocks BlindLock’s hardware-sealed app anchor (app path; not native chip PIN policy) ▼ HKDF combines three factors into the vault key: 1) File ── encrypted vault concealed in the carrier 2) Password ── Argon2id, memory-hard (512 MiB–4 GB per device) 3) Device ── non-exportable anchor in security hardware (TPM 2.0 / Secure Enclave / StrongBox) (optional 4th factor: security key via FIDO2) │ a wrong device yields a mathematically wrong key ▼ Vault is decrypted — in memory only ▼ vault open in memory ▼ instantly erased the moment you lock
Honest answers to the awkward cases.
BlindLock cannot reset it. Use your recovery phrase — generated during setup and shown exactly once — to derive a recovery key outside the normal hardware-binding path.
The carrier and password are not enough without the authorised device. Restore an encrypted BlindLock backup on the new device with the separately stored recovery phrase.
As long as you still have the device that sealed the vault, you are fine. Generate a new recovery phrase from settings — it replaces the old one.
They have only the file — which is encrypted and bound to your security chip either way. They still lack your password and your device — and, if enabled, your security key. Without those factors, none of it can be read.
Exactly 1,000 lifetime licences in three phases — secure yours at the lowest price BlindLock will ever have.