Your complete password vault — passwords, notes and 2FA secrets — lives encrypted inside an ordinary-looking PNG file. Larger files use separate encrypted containers. Here is what happens during setup and every unlock.
First-time setup takes about two minutes. After that, every time you open BlindLock you wait about ten seconds for the PIN check. It feels slow, and that is the point: if someone later tries to guess your PIN — for example after stealing your device — every wrong attempt costs those same ten seconds. Without that brake, a program could try thousands of PINs in a few minutes. With it, the same attack takes days or weeks and is not worth the effort. The PIN only opens BlindLock on your device. It does not open your vault — that still needs your password and this exact device.
Pick any PNG file on your device. A holiday photo, a screenshot — whatever looks unremarkable in your own filesystem. BlindLock inspects the carrier's capacity and confirms it can hold the payload without visible distortion.
The carrier stays exactly where you put it. There is no "vault folder" created anywhere on disk.
You set your password, and BlindLock anchors non-exportable key material in the device's security hardware — TPM 2.0, Secure Enclave or StrongBox, depending on the platform. You can also set up a security key such as a YubiKey, Google Titan or SoloKey.
None of these is enough alone: not the file, not the password, and not the device. Only all three, combined through HKDF, derive the vault key. The same file with the same password yields a mathematically wrong key on any other machine.
Passwords, TOTP seeds and notes are encrypted in memory before being written into the carrier. Larger documents and media go into separate encrypted file-vault containers, so the two storage types remain distinct. The login-stego password vault uses classical 256-bit dual AEAD. File-vault containers use authenticated encryption as documented on the Security page.
BlindLock stores your encrypted password vault invisibly inside the image you chose. Visually nothing changes: before and after, the file looks the same. You cannot tell from looking at the image that data is hidden inside it.
Keep the active carrier safe and back it up deliberately. For migration and emergencies, also create an encrypted BlindLock backup and keep its recovery phrase separately. If you use file vaults, back up each container together with its recovery file and recovery factor. You may choose local media, an external drive or a cloud-synchronised folder. BlindLock does not operate a central backup service.
Every unlock follows the same local cryptographic path. A brief encrypted connection verifies licence entitlement and version status, but no vault contents are sent. Once unlocked, the vault continues to work locally until the session closes.
┌─────────────────────── carrier.png ───────────────────────┐ │ │ │ ordinary-looking image data │ │ + │ │ concealed, encrypted password vault │ │ ├── passwords and login data │ │ └── notes and TOTP secrets │ │ │ └──── concealment + encryption + hardware binding ─────────┘ large documents and media ──► separate encrypted file-vault containers How the vault opens: PIN ──► entry gate (Argon2id, 256 MiB, ~10 s — not a vault factor) │ unlocks BlindLock’s hardware-sealed app anchor (app path — not native chip PIN policy) ▼ HKDF combines three factors into the vault key: 1) File ── encrypted vault concealed in the carrier 2) Password ── Argon2id, memory-hard (512 MiB–4 GB per device) 3) Device ── non-exportable anchor in security hardware (TPM 2.0 / Secure Enclave / StrongBox) (optional 4th factor: security key via FIDO2) │ a wrong device yields a mathematically wrong key ▼ Vault is decrypted — in memory only ▼ vault open in memory ▼ instantly erased the moment you lock
Honest answers to the awkward cases.
BlindLock cannot reset it — and there is no way around it. The recovery phrase does not replace your password. It only stands in for the hardware key. Treat your master password with the same care as the vault itself.
The carrier and password are not enough without the authorised device. Restore your encrypted backup on the new device — with the backup file and the separately stored recovery phrase. Then sign in with your master password as usual.
As long as you can still sign in on your device, nothing is lost: reveal your twelve words again under Backup and write them down anew. They are always the same twelve — every backup belongs to exactly those.
They have only the file — which is encrypted and bound to your security chip either way. They still lack your password and your device — and, if enabled, your security key. Without those factors, none of it can be read.
Cloudless storage, privacy, hardware binding and steganography — then compare honestly.
Open the interactive demo with the real desktop flow — or check Lifetime pricing for later.