Family Vault
The documents you will not be able to find at 2am.
Insurance policy numbers. The deed. Account recovery codes. Who to call about the mortgage. In a bad week these are the things nobody can locate, and the search happens on the worst day of the year.
Read this before you put anything in. The vault is encrypted with a passphrase you choose. That passphrase is never stored, never sent anywhere, and cannot be reset by anyone including me. If you lose it, the contents are gone permanently. That is not a flaw, it is the entire point, and it is the reason to write the passphrase on paper and keep the paper somewhere physical.
How it is protected
Everything you save is wrapped three times, in three different ciphers, each with its own key. From the inside out: AES-256-GCM, then ChaCha20-Poly1305, then AES-256-CTR sealed with an HMAC-SHA512 tag that is checked before a single byte is decrypted. The three keys come from your passphrase through PBKDF2-HMAC-SHA512 at six hundred thousand iterations, then split apart so no layer shares a key with another.
The honest limits, stated plainly because a security product that oversells itself is worse than one that says nothing. Three layers do not rescue a weak passphrase, so pick a long one. This runs entirely in your browser on your device, which means it protects the stored file, not a device someone else already controls. There is no server, no account, and no copy of anything anywhere but here.
Encryption is unavailable on this page. The browser is not exposing Web Crypto, which usually means the page is being served from a preview or a non-secure origin. The vault will not write anything in that state rather than store your documents unprotected. Open the site over https and it will work.
This preview cannot save. Storage is blocked in this frame, so the vault works but forgets everything on reload. Use the encrypted export button to keep anything you enter here. On the real site it saves normally.
Create your vault
Pick a passphrase. Length beats cleverness. Four or five unrelated words you can picture is stronger and easier to remember than one mangled word with symbols in it.
Type a passphrase to see an estimate.
Unlock
Your vault is on this device. Enter the passphrase to open it.
Unlocking deliberately takes about a second. That delay is the key stretching, and it is what makes guessing expensive for anyone who takes a copy of the stored file.
Add an entry
Nothing here is uploaded. A file you attach is read in the browser, encrypted, and kept on this device.
Keep attachments under about two megabytes each so the vault stays quick to open.
Backup and moving between machines
The export is a single file, still encrypted with the same three layers and the same passphrase. It is safe to email to yourself, keep on a USB stick, or put in cloud storage, because without the passphrase it is noise. This is also the only way to move the vault to another device.
The printed index lists titles, categories and where the paper originals live. It deliberately leaves out your notes and never includes attachments, so it is safe to keep in a folder with the physical documents.
What to put in it, in order
Most people stall because they try to do all of it at once. This is the order that gets a usable vault in an evening.
- Identity. Birth certificates, passports, social security cards. Not the numbers alone, a photo of the document and a line saying which drawer the original is in.
- Who to call. The mortgage servicer, the insurance claims line, the bank fraud line, your doctor. Numbers you looked up yourself, not numbers from an email.
- Recovery codes. The one-time backup codes for your email and your bank. These are the keys to everything else and most people leave them in a downloads folder.
- Insurance and property. Policy numbers, the deed, the title, the survey.
- Receipts and warranties. The boring one that pays for itself the first time you make a claim.
- Medical and legal. Prescriptions, allergies, the power of attorney, the will and where the signed original is.
Digital and physical should mirror each other. One encrypted vault on your device, one labelled folder in a fireproof box, and an index that tells each one where the other half is. Sources for the practice behind this: Ready.gov on financial preparedness and CISA Secure Our World.