cat about.md

Why PingVaults Exists

The story behind a client-side encrypted recovery vault — and the problem it was built to solve.

// motivation

The problem we saw

Digital accounts and crypto assets can become inaccessible when an owner dies or becomes incapacitated without a tested recovery plan. Hardware wallets sit in drawers, recovery records go missing, and families may not know which assets or accounts exist.

Existing tools solve different parts of the problem: password managers can share access, legal documents establish authority, and multisignature wallets distribute key control. None removes the need to coordinate technical recovery instructions, trusted people, and a legally valid estate plan.

PingVaults encrypts recovery instructions in the browser, uploads ciphertext to Arweave, and notifies an emergency contact after an inactivity sequence. It is a technical continuity tool, not a will, trust, or substitute for legal advice.

// author

Who writes these guides

Micah Chan founded PingVaults, builds the product, and writes and maintains the guides on this site.

Each guide is based on the official help pages, laws and regulator guidance listed in its sources, and shows the date they were checked. When a platform changes its process, the guide is updated and re-dated. Micah is not a lawyer, tax adviser or financial adviser: the guides are general information, so check your own situation with a qualified professional.

// security_philosophy

Security philosophy

✓

Client-side encryption by default — the vault save flow is designed to send ciphertext and recovery metadata, not the recovery phrase.

✓

High-entropy recovery — use a long, unique phrase agreed and stored offline; personal facts and short answers are guessable.

✓

Portable recovery — export the ciphertext and metadata, keep a tested offline decryptor, and avoid relying on one account or gateway.

✓

Verify the boundaries — review the open crypto core, inspect network requests, and treat delivered application code as part of the threat model.

✓

Minimize exposed data — the server-side datastore is designed to hold encrypted content and the metadata required for recovery.

// threat_model

Threat model

This threat model separates a database-only breach from compromised browser code, a compromised device, and a guessable recovery phrase.

Server database breachedAn attacker gets AES-256-GCM ciphertext, salt, IV, and the recovery schema. They can test likely phrases offline, so a long, unique recovery phrase is essential.
PingVaults goes rogue / is coercedCSP limits cross-origin connections and the crypto core is reviewable, but same-origin requests remain possible. A malicious deployment is not fully mitigated by CSP; use exported backups and a trusted offline decryptor for recovery.
CDN / Vercel tampers with JS bundlesThe /verify page exposes build-time file hashes for comparison. This helps detect mismatches but does not independently prove that a live deployment is benign.
PingVaults shuts down entirelyPreviously exported JSON includes ciphertext and works with a saved offline decryptor without PingVaults or any gateway. Test this independent copy; online availability is not guaranteed.

// tech_stack

Technology

Encryption

WebCrypto API — PBKDF2-SHA256 (600k iterations) + AES-256-GCM

Storage

Arweave via ArDrive Turbo (public ciphertext storage; older Irys vaults still readable) + AWS DynamoDB (metadata)

Authentication

Email OTP + Google OAuth, JWT sessions (HTTP-only cookies)

Notifications

Cloudflare Email Service (email) + an hourly Cloudflare Cron Trigger (inactivity switch engine)

Frontend

Next.js 16 (App Router), TypeScript, Tailwind CSS, next-intl (EN + ZH)

Deployment

Cloudflare Workers (website and scheduled checks) + AWS DynamoDB (metadata)

// open_source

Open source policy

The encryption core—PBKDF2 key derivation, AES-256-GCM encryption, and offline decryptors—is published under the MIT license for review and testing. The UI, inactivity switch engine, and API routes are proprietary. A database-only breach and malicious code delivered to the browser are different threats; the latter is not eliminated by the open crypto module alone.

pingvaults-crypto (MIT) ↗Verify deployment integrity →

// roadmap

Roadmap

✓

Client-side encrypted vault with Arweave storage and offline exports

AES-256-GCM + PBKDF2, browser-local encryption, Arweave upload

✓

Inactivity switch with configurable ping schedule

Hourly Cloudflare Cron Trigger, email delivery through Cloudflare Email Service, emergency contact notification

✓

Offline HTML decryptor (English + Chinese)

Standalone files, no server dependency, WebCrypto embedded

✓

File attachments (documents, images) in vault

Client-side encryption for file attachments within plan size limits

○

Multi-vault support and shared family vaults

Separate encryption contexts, granular access control

// contact

Get in touch

info@pingvaults.com𝕏 @PingVaultsGitHub ↗

PingVaults is a product of Brightcore Technologies LLC.

$ ./create_vault.sh

Create My Vault →