Secret Key is a self-hosted emergency access system for password databases. It splits the master password into shares distributed among trusted people.
The idea came to me during a trip in the mountains. I started wondering what would happen to all my online accounts if I didn't come back.
It uses Shamir Secret Sharing via secrets.js, compatible with iancoleman.io/shamir. Trusted people authenticate via SMS, and once enough shares are provided, the master password is reconstructed in the browser. A 48-hour download lock gives the owner time to react using a Panic Button that blocks the download.
Some limitations: the project has not undergone an independent security audit, SMS relies on an external provider, and the 48-hour lock delays downloading the vault but cannot prevent someone with enough shares from mathematically reconstructing the secret. The demo UI is currently only in Polish.
I'd appreciate feedback on the threat model: what attack scenarios or security assumptions am I overlooking, particularly regarding collusion between trusted participants?
karpatka122•55m ago
It uses Shamir Secret Sharing via secrets.js, compatible with iancoleman.io/shamir. Trusted people authenticate via SMS, and once enough shares are provided, the master password is reconstructed in the browser. A 48-hour download lock gives the owner time to react using a Panic Button that blocks the download.
Some limitations: the project has not undergone an independent security audit, SMS relies on an external provider, and the 48-hour lock delays downloading the vault but cannot prevent someone with enough shares from mathematically reconstructing the secret. The demo UI is currently only in Polish.
I'd appreciate feedback on the threat model: what attack scenarios or security assumptions am I overlooking, particularly regarding collusion between trusted participants?
Project: https://secretkey.website Demo: https://app.secretkey.website Documentation: https://secretkey.website/docs/ GitHub: https://github.com/mateuszkarpierz/secret-key