How Legacy Locker Works
We built a system where even we cannot read your data. Here is exactly how your digital assets are secured from end-to-end.
1. Client-Side Encryption
Everything starts on your device. When you create a vault, your browser generates a secure Data Encryption Key (DEK). Your files and text are encrypted using AES-256-GCM locally. The raw data never touches our servers.
2. Master Password Security
Your DEK is wrapped (encrypted) using a key derived from your Master Password using Argon2, the winner of the Password Hashing Competition. We only store the wrapped key, meaning without your password, the vault is mathematically impossible to open.
3. Nominee Assignment
When you assign a nominee, your session briefly decrypts the DEK, and re-encrypts it using a unique 6-digit Sharing PIN. This PIN is shown to you only once. You must provide this PIN to your nominee in person or via a secure channel.
4. Dead Man's Trigger
If you fail to log in for your specified inactivity period, or your scheduled date arrives, Legacy Locker emails your nominee with a unique unlock link. Upon visiting the link, they enter the Sharing PIN. Their browser locally unwraps the DEK and decrypts the vault content right before their eyes.