Compared

Why BlindLock is different.

LastPass, 1Password, Bitwarden and Proton Pass are established products built around provider-hosted encrypted vaults. KeePass takes a local-file approach, but does not use BlindLock's built-in steganographic carrier and device binding. BlindLock takes a different approach to both models. Here is what that changes.

Criterion BlindLock LastPass 1Password Bitwarden Proton Pass KeePass
Vault storageWhere your encrypted vault physically lives Local, on your own device. The encrypted vault data sits in the PNG carrier or in separate file-vault containers and is never transmitted to BlindLock. Cloud Cloud Cloud (self-host possible) Cloud Local only (KDBX file)
Account & loginWhat unlocks the account and vault No vault cloud account — carrier + password + device Email + master password Email + password + Secret Key Email + master password (passkey login available) Proton account (email + password) No account — password/key file
Steganographic vaultVault concealed in an ordinary-looking file (deniability depends on threat model) PNG carrier with an optional decoy region — — — — —
Risk from copied vault dataWhat an attacker can work on offline, and what they still need in order to unlock it BlindLock keeps no customer vaults on a central server. A stolen PNG file on its own does not open the vault hidden inside it. That vault is sealed to the hardware of the authorised device through TPM 2.0, Secure Enclave or StrongBox/TEE, and your password is required on top. The local vault data is also authenticated-encrypted with AES-256-GCM and XChaCha20-Poly1305, one after the other. Central encrypted vaults can be bulk-stolen offline Central vaults — PQ hybrid TLS on web transport (not vault-at-rest) Central encrypted vaults (self-host possible) Central encrypted vaults Local file only — no provider vault server
Hardware-bound keysKey material anchored in platform security hardware TPM 2.0 / Secure Enclave / Android StrongBox or TEE where available — Device-linked (cloud-backed) — Device-linked No hardware sealing (KeePassXC: quick unlock only)
Hardware-bound unlockVault key material is sealed to platform security hardware on the authorised device Sealed to TPM 2.0, Secure Enclave or a mobile hardware root of trust. The PIN governs unlocking the app. — — — — —
No central vault databaseWhether vault contents are transmitted to the provider No vault upload — only a brief licence and version check Server-side vault Server-side vault Server-side (self-host possible) Server-side vault Local file — no provider vault server
Key derivationWhat a single brute-force guess costs the attacker (time × memory) Argon2id, memory-hard (512 MiB–4 GB by device class) PBKDF2 — not memory-hard, GPU-friendly PBKDF2 + SRP — not memory-hard PBKDF2 (600k) default for many accounts — Argon2id available (~32–64 MiB) bcrypt + SRP — low memory cost per guess KeePassXC: Argon2 (~64 MB default) / KeePass 2.x: AES-KDF by default
Verifiability of the cryptographyWhether the cryptographic building blocks in use can be inspected publicly BlindLock uses the open-source libcrux AEAD building blocks AES-256-GCM and XChaCha20-Poly1305. Formally verified are the AES-256-GCM core and the ChaCha20-Poly1305 core that XChaCha20-Poly1305 builds on. Closed Closed Open source Partially open Open source
TOTP 2FA built inNo second authenticator app needed Built in — codes stay inside the vault Free plan includes TOTP. Advanced or hardware-backed MFA is often on a paid tier. Built in Paid tier (Premium) Paid tier (Plus) KeePass 2.x: third-party plugin required / KeePassXC: built in
Pricing modelOne-time vs. recurring revenue Lifetime licence with a single payment for one desktop device at a time. iOS and Android are always free for everyone. Subscription Subscription Subscription (free tier) Subscription (free tier) Free (open source)
Selected publicly documented incidentsMajor incidents involving vault or customer data No central vault server. To date, no comparable incident has been publicly documented. 2022 — encrypted vault backups stolen (~30M reported) — cracking linked through 2025 No vault exfiltration No vault exfiltration No vault exfiltration No central provider vault
Fully met Partial or conditional Not available / not applicable

What does a stolen vault file cost to crack?

With conventional vault files, an attacker can try passwords offline on graphics cards after copying the file. Low-memory methods allow many tries at once. High-memory methods slow that down. BlindLock adds another hurdle in front: without the hardware the vault is bound to, a copied file yields no usable offline password try.

BlindLock

A copied vault file alone is not enough to start guessing passwords.

  • The PNG carrier and file vaults are bound to your device hardware (TPM 2.0, Secure Enclave, or StrongBox/TEE). Without that device, a copy is useless.
  • When you open BlindLock: each wrong PIN try at the entry gate takes about 10 seconds (Argon2id). After several failures, the app also locks out for a while.
  • Argon2id is memory-hard: each try needs 512 MiB to 4 GB of memory — depending on the device class.
  • On a GPU with 24 GB memory: each try at 512 MiB means at most about 48 parallel tries. At 4 GB, only about 6. That is capacity, not guesses per second. Real speed depends on the specific GPU model.

Typical defaults elsewhere

Product Key derivation (typical default) Memory per guess Offline guessing on a GPU
BlindLock Argon2id (512 MiB–4 GB by device class) High On a foreign device, files alone are useless — TPM 2.0 / Secure Enclave / StrongBox
LastPass PBKDF2 Very low Many parallel guesses
1Password PBKDF2 + Secret Key Very low. The Secret Key raises the attacker’s effort on top of that. Considerably harder without the Secret Key. If the Secret Key is known, many parallel PBKDF2 guesses are possible.
Bitwarden PBKDF2 or Argon2id (depends on the account setting) Very low to medium Many parallel guesses on PBKDF2. With Argon2id there are fewer.
Proton Pass bcrypt Very low Many parallel guesses
KeePass 2.x AES-KDF (default) Very low Many parallel guesses
KeePassXC Argon2 (~64 MiB default) Medium In theory hundreds of parallel guesses on a GPU with 24 GB of memory

With BlindLock, binding to the authorised hardware blocks first. When unlocking in the app, each try costs Argon2id at 512 MiB to 4 GB — depending on the device class. The figures 48 and 6 only describe how many tries fit at once in 24 GB of GPU memory — not how many per second are possible. An honest timing rate needs a measured benchmark on a named GPU model. Values for the other products are typical shipping defaults — some let users raise them.

Three structural differences worth understanding

The matrix above is specific. These are the patterns behind it.

No cloud is not the same as "encrypted cloud"

A zero-knowledge cloud manager still transmits an encrypted vault to provider infrastructure. BlindLock never transmits vault contents to BlindLock servers and operates no central customer-vault database or vault cloud account. Licence and version checks remain strictly separate from your secrets.

Long-term ciphertext risk starts today

Encrypted vaults stolen today can be stored and attacked later. BlindLock reduces that exposure by design: there is no central vault database to harvest, and resting vault files use 256-bit authenticated encryption, generally regarded as beyond practical quantum attack for confidentiality under current estimates. That reduces risk — it is not a promise that every future attack is impossible.

Hardware binding keeps a copied file locked

An attacker who obtains a cloud vault can often attack it offline on any machine. With BlindLock, normal unlock needs the carrier file, the password, and the authorised device. Optionally, a security key (YubiKey, Google Titan, or SoloKey) adds a fourth factor. Recovery is a separate, deliberate path.

Context: the LastPass 2022 breach In December 2022 LastPass disclosed theft of encrypted customer vault backups (on the order of ~30 million accounts in later reporting, figures vary by source). In subsequent years, more than $35 million in cryptocurrency theft has been publicly traced to cracking of weak master passwords on those backups. In 2025 U.S. investigators linked a ~$150 million heist to that same class of stolen vault material. The issue was not a break of AES itself, but bulk possession of offline-attackable ciphertext. BlindLock is designed so there is no central customer-vault database of that kind. June 2026: LastPass reported that customer CRM/support data (names, addresses, phones, support cases) — not vaults — was accessed via a supply-chain incident involving Klue (TechCrunch, 23 June 2026). Vaults remained encrypted. Personal customer data did not. See also the blog for longer security writing as it is published.
Guides

Go deeper on the vault model.

Cloudless storage, privacy, hardware binding and steganography — then decide with clear trade-offs.

Cloudless vault Privacy Hardware binding Steganography Security

If "local-first, disguised, hardware-bound" sounds like what you actually want…

Lifetime licences from $49, available now.

Buy a lifetime licenceLifetime from $49 · pay once Read the security page
Comparison based on publicly available information and vendor documentation as of 19 July 2026. Competitor features and breach histories change over time — I update this page as I verify changes. This is not legal advice and is not intended as a statement about competitors beyond documented facts.