Seven layers between your passwords and everyone else.
Crypt BlackBox protects passwords with seven layers; an attacker must defeat several of them at once, and the most important one is the button under your thumb.
- 01
It never goes online.
No Wi-Fi, no cloud, no account to hack. Your vault lives only in the device.
No Wi-Fi and no internet connection. Bluetooth Low Energy only, and only while unlocked.
- 02
Encrypted with your PIN and the device itself.
Everything stored is encrypted. The key comes from your 6-digit PIN combined with a secret sealed inside the BlackBox's own security hardware, so a copy of its memory is useless anywhere else.
AES-256-GCM vault encryption · PBKDF2-HMAC-SHA256 from your PIN · key sealed to one-time-programmable security memory in shipping units.
- 03
Guessing your PIN takes decades.
After 3 wrong tries the device makes you wait, and the waits grow to 30 minutes per try. Unplugging it doesn't reset the count.
3 free tries, then 30 s, 2 min, 10 min, 30 min per try · counted before the PIN is checked, so cutting power can't erase a guess.
- 04
Nothing leaves without your press.
When your phone asks for a password, the BlackBox screen shows exactly which account, with NO pre-selected. You choose YES and press OK. Ignore it and it says no after 30 seconds.
Default NO · auto-deny after 30 s · a press that started before the prompt appeared is ignored.
- 05
Only your phones can connect.
Each phone you add gets its own secret key, kept in the phone's secure hardware. You add phones by scanning a one-time QR code on the BlackBox, and you can remove any of them from the device.
Own ECDSA P-256 key per phone in Android Keystore · single-use QR valid 2 minutes · up to 4 phones.
- 06
Fakes are caught.
Every BlackBox has a unique identity key that can never be read out, not even by its own software. The app checks it at every connection, so a look-alike device cannot trick your phone.
Per-unit RSA-3072 identity key used only through a hardware digital-signature engine · factory certificate in shipping units.
- 07
Invisible when locked.
A locked BlackBox shows a clock and is not visible over Bluetooth. It locks itself after a time you choose and wipes passwords from its working memory.
Bluetooth off for outsiders while locked · auto-lock after 30 s, 1, 2 or 5 min · keys wiped from working memory on lock.
What Crypt deliberately does not do: no cloud copy, no telemetry, no master key, no backdoor. The company cannot see, reset or recover your PIN or your passwords. Read the full security design →
How a password leaves the BlackBox.
Even a compromised phone can only ask for a password; it cannot take one.
The technical version.
| Layer | Mechanism |
|---|---|
| Storage encryption | AES-256-GCM authenticated encryption of the whole vault; a fresh random nonce on every save; the record header (including key-derivation settings) is authenticated too |
| Key derivation | PBKDF2-HMAC-SHA256 from the 6-digit PIN with a random 128-bit salt, split into separate verification and encryption keys with HMAC-SHA256 |
| Device binding (shipping units) | Derived key passed through a hardware HMAC engine using a 256-bit key in one-time-programmable security memory that software cannot read; the vault only opens on the device that created it |
| PIN attempt limits | Attempt counted and lockout armed in storage before the PIN is checked, so cutting power cannot erase a wrong guess. Delays: 3 to 5 failures 30 s each, 6 to 8 failures 2 min, 9 to 11 failures 10 min, 12 or more 30 min |
| Device identity | Per-unit RSA-3072 key used only through a hardware digital-signature engine; the private key is stored encrypted under a hardware key and never exists in readable form after manufacturing. Each signature is verified before release (fault-attack countermeasure) |
| Genuine-device check (shipping units) | Factory certificate signed by the Crypt manufacturing key (ECDSA P-256); the app ships with the public key and verifies offline |
| Phone link | Bluetooth LE Secure Connections pairing with a 6-digit passkey shown on the device (protects against eavesdroppers and man-in-the-middle). On top of that, an application-level encrypted channel: a fresh ephemeral ECDH P-256 exchange per session, the device signs the full handshake, keys derived with HKDF-SHA256, separate keys for each direction |
| Message integrity | Every message carries an HMAC-SHA256 tag and a strictly increasing counter; replayed, reordered or altered messages are rejected; six bad messages in a row drop the connection |
| Phone authentication | Each phone holds its own ECDSA P-256 key in Android Keystore (hardware StrongBox where available) and proves it at every session; maximum 4 phones; registry stored encrypted under the vault key |
| Pairing protection | New phones only by physical approval plus a single-use QR token valid 2 minutes, or a 6-digit comparison code shown on both screens |
| Session limits | Sessions close after 2 minutes idle, 15 minutes in total, on disconnect, or when the device locks |
| Approval prompts | Name the exact account and action; default NO; auto-deny after 30 s; a button press that started before the prompt appeared is ignored |
| Memory hygiene | Keys, PINs and passwords wiped from working memory on lock and after use |
| Storage resilience | Two alternating encrypted copies, each verified after writing; the newest valid copy is used and a damaged one is repaired |
| Platform (shipping units) | Verified boot (only signed Crypt firmware runs), chip-level storage encryption, debug and download interfaces locked |
| Randomness | Keys, nonces and generated passwords come from a hardware true-random generator |
The PIN-guessing figure
With 1,000,000 possible PINs and one try per 30 minutes after the 12th failure, trying every PIN takes about 57 years; on average a thief needs about 28 years. This counts guesses on the device itself; copying the memory to guess faster is stopped by device binding in shipping units.
What Crypt deliberately does not do
No cloud copy, no telemetry, no master key, no backdoor. The company cannot see, reset or recover your PIN or your passwords.