Secret Key: Shamir-based Emergency Access for Password Vaults
A self-hosted, decentralized emergency recovery system for your master passwords.
1Digital Estate Planning
Secret Key addresses the challenge of securing digital assets like cloud storage and cryptocurrency wallets after a user's death. It provides a non-legal, technical contingency plan for accessing password vaults. By distributing master password fragments among trusted individuals, it ensures that sensitive data remains accessible to heirs without relying on centralized third-party services.
2Shamir Secret Sharing
The system utilizes Shamir's Secret Sharing algorithm to split a master password into multiple fragments. A user can define a threshold, such as three out of five shares, required to reconstruct the original secret. This mathematical approach ensures that no single share provides information about the master password, maintaining high information-theoretic security standards.
3Self-Hosted Architecture
Secret Key is designed as a fully self-hosted solution, eliminating reliance on external cloud providers or central databases. The backend runs on PHP 8+ using flat files, while the frontend operates entirely offline in the browser. This architecture ensures that sensitive configuration data never leaves the user's private server infrastructure.
4Multi-Layered Authentication
Accessing the vault requires a rigorous verification process involving multiple layers. Authorized individuals must provide their specific shares and complete a 2FA SMS verification linked to the account. Without the correct number of shares and the associated phone number, the system makes it mathematically impossible to reconstruct the master password.
5Panic Button Mechanism
To prevent unauthorized access, the system includes a 48-hour delay and a panic button feature. Upon a successful reconstruction attempt, the system sends an email alert to the owner. This allows the owner to permanently revoke access with a single click if the recovery attempt was initiated without their knowledge or consent.
6Offline Configuration Tools
The dashboard tools for generating shares and printable cards operate entirely offline within the user's browser. No data is transmitted during the configuration phase, ensuring that the master password remains private. Users can generate physical cards in ISO ID-1 format, which contain the necessary fragments for their designated trusted individuals.
7Compatibility and Flexibility
Secret Key is compatible with any password manager that uses a master password, including KeePassXC, Bitwarden, and 1Password. Because it is agnostic to the underlying vault software, users can integrate it into their existing security workflows. The system simply manages the recovery of the master password itself, not the vault data.
8Security Through Separation
Sensitive configuration files are stored outside the public web directory to prevent accidental exposure via server misconfiguration. The system employs bcrypt for password hashing and implements rate limiting to mitigate brute-force attacks. By combining nine independent layers of protection, the system ensures that a single point of failure does not compromise security.
9SMS Integration Details
The system uses the SMSPlanet API for 2FA verification. It supports WebOTP API, allowing mobile browsers to automatically fill the verification code from incoming SMS messages. This feature requires the domain to be explicitly configured, ensuring that the automated process only triggers on the user's verified, self-hosted domain environment.
10Mathematical Integrity
The reconstruction process uses Lagrange interpolation over a finite field to recreate the secret. The system performs mathematical consistency checks on the shares before attempting final reconstruction. This ensures that typos or corrupted data are identified early, preventing the system from processing invalid inputs that could lead to incorrect password attempts.
11Recommended Security Practices
For maximum protection, the developers recommend using a hardware security key, such as a YubiKey, in conjunction with the password vault. Even if the master password is reconstructed, the hardware key provides an additional layer of physical security, ensuring that the vault remains inaccessible without the physical device present.
12System Implementation Summary
Secret Key provides a robust, decentralized framework for emergency access by leveraging threshold cryptography. By keeping the logic self-hosted and offline-first, it empowers users to manage their digital legacy securely. It serves as a critical tool for those seeking to bridge the gap between legal estate planning and modern digital security.