ENVELOPE ENCRYPTION
Per-Record AES-256-GCM
Every single entry is encrypted with its own uniquely generated 96-bit initialization vector. A compromise of one record gives zero insight into any other record in your vault.
OFFLINE BY DESIGN
ARGON2ID 64 MiB
AES-256-GCM
Your secrets never leave your machine.
Voltrex Vault is a zero-knowledge desktop password and secrets manager. Powered by local AES-256-GCM envelope encryption, hardened Argon2id key derivation, and an embedded SQLite database. No mandatory cloud accounts. No telemetry.
VOLTREX VAULT v1.0
_
□
×
Key Derivation Function
Argon2id
64 MiB memory, 3 iterations, 4 lanes. Resistant to GPU / ASIC brute-force attacks.
Cipher Engine
AES-256-GCM
Envelope encryption with per-record random 96-bit IVs and 128-bit integrity tags.
Data Storage Engine
Embedded SQLite
Zero external dependencies. Filesystem restricted to
0600 permissions.Process Security
Context Isolation
Sandbox enabled. Node integration disabled. Strict CSP with
connect-src 'none'.
APPLICATION TOUR
Built with purpose. Engineered for daily focus.
An ergonomic, dark-mode interface built with high-contrast typography, keyboard shortcuts, and zero distracting visual noise.
Screenshot 1: Main Vault & Category Overview
DASHBOARD
CORE CAPABILITIES
Everything you need. Nothing compromised.
Essential credential management tools designed to keep you in control of your data without third-party subscriptions.
INTEROPERABILITY
RFC 4180 CSV Importer
Migrate seamlessly. Built-in parser extracts credentials from Bitwarden, Google Chrome, 1Password, and LastPass CSV exports, including multi-line notes and 2FA secrets.
ENTROPY ANALYSIS
Cryptographic Generator
Generate non-predictable passwords with real-time Shannon entropy calculation (up to 128+ bits). Tailor character sets and filter visually ambiguous glyphs like 0/O/l/1.
PORTABILITY
Encrypted Backup Containers
Export standalone .voltrex containers encrypted with master-password-derived keys. Supports atomic rollback snapshots and cross-vault collision detection.
SYSTEM HARDENING
Inactivity Lock & Clipboard Wipe
Automatic inactivity locks engage when user interaction stops. Copied passwords are automatically purged from the operating system clipboard after 15 to 120 seconds.
AIR-GAPPED READY
Zero Mandatory Cloud Services
Voltrex Vault has no telemetry, no tracking analytics, and no remote dependencies. It functions perfectly inside completely air-gapped environments.
CRYPTOGRAPHIC RIGOR
Security by implementation, not obscurity.
How Voltrex Vault protects your credentials against physical theft, memory snooping, and tampering.
KEY HIERARCHY & ENVELOPE ENCRYPTION
VERIFIED PROTOCOL
01
Master Password Input
Provided by user. Never persisted to disk in any form.
→
02
Argon2id KDF
64 MiB RAM, 3 iterations, 32-byte salt → derives 256-bit KEK.
→
03
DEK Unwrapping
KEK decrypts the Vault Data Encryption Key (DEK) via AES-256-GCM.
→
04
In-Memory Decryption
Individual records decrypted on demand. Zeroized on lock.
| Attack Vector | Security Guarantee | Mitigation Technique |
|---|---|---|
| Database Stolen at Rest | Zero Plaintext Exposure | All payload blobs stored as AES-256-GCM ciphertext in SQLite with 0600 filesystem mode. |
| Ciphertext Tampering | Cryptographic Rejection | 128-bit authentication tag checked prior to decryption. Any altered bit raises CryptoIntegrityError. |
| Memory Snooping | Ephemeral Key Lifetime | Key buffers (DEK, KEK) are zeroized immediately with buf.fill(0) upon vault locking or app shutdown. |
| IPC Spoofing / XSS | Strict Boundary Isolation | Electron contextIsolation: true, strict CSP (connect-src 'none'), senderFrame validation. |
| Data Corruption on Restore | Pre-Restore Rollback | Automatic point-in-time SQLite snapshot created before executing any container restore operations. |
GET VOLTREX VAULT
Install on your operating system.
Binaries are packaged with automated SHA-256 blockmaps and signed executables.
Windows
x64 Installer (Windows 10 / 11)Standard NSIS Setup with desktop shortcut and automated uninstaller.
Linux (.tar.gz)
x64 Portable ArchivePortable Linux binary archive. Extract and run on any modern Linux distribution.
Linux AppImage
x64 Standalone ExecutableSingle executable for Linux with zero dependencies. Run directly after chmod +x.
BUILD FROM SOURCE (NODE 18+)
REPRODUCIBLE BUILD
# Clone the repository
git clone https://github.com/ziard47/voltrex-vault.git
cd voltrex-vault
# Install dependencies
npm install
# Run all 44 automated cryptographic and security tests
npm test
# Launch the desktop application
npm start
DOCUMENTATION
Transparent specifications.
Inspect the underlying security proofs and system architecture files directly in this repository.
System Architecture (ARCHITECTURE.md)
Comprehensive breakdown of IPC isolation, SQLite repository schema, key unwrap lifecycles, and memory zeroization.
Threat Model & Risk Matrix (THREAT_MODEL.md)
Formal analysis of adversary capabilities, offline attacks, memory dumping mitigations, and cross-site scripting prevention.