A seed phrase vault with AES-256 encryption that never touches the internet.
Free and open source at launch
No account. No server. No telemetry. The vault is a file on your own disk, and the only key to it is a password that exists nowhere but in your head.
Security
Every claim here maps to a line of code you can read. There is no server in the picture and no policy to take on faith. The work happens on your machine.
I
Seed phrases are sealed with AES-256-GCM. Your password is stretched through Argon2id and HKDF into the key that opens the vault, a deliberately slow path that makes brute force expensive.
II
It is never stored. Not hashed on a server, not cached in a cookie. Without it the vault stays shut for everyone, ourselves included. That is why no recovery link exists.
III
No account, no sync, no server, no telemetry. The vault lives in your device's storage and nowhere else. Pull the network cable and SpaceOne behaves exactly the same.
Procedure
I
The first time you open SpaceOne you set a vault password. It never leaves the device and the app never writes it down.
II
Paste a phrase you already own, or generate a fresh 12-word BIP39 phrase, the same standard your wallet uses.
III
Seeds stay encrypted at rest. Each reveal asks for the password again, so a vault left open is still a vault closed.
Portability
One encrypted file that only your password opens. Carry it to any computer, keep it wherever you want: a USB drive, a second laptop, a drawer. It is useless to anyone who finds it.
Questions
There is no recovery. None. The password is not stored anywhere, so there is nothing to reset and no one to ask. The key that opens your vault is derived from the password itself; without it, the ciphertext stays ciphertext.
That is the feature, not a gap. A vault with a back door has a back door for everyone. Write your password down and keep it somewhere physically safe.
No, and not because we promise it. There is no server to receive your data and no account tied to you. Encryption and decryption happen in your browser, on your machine. Watch the network tab: nothing goes out.
Yes. Free and open source, with no paid tier, no sign-up and no data to monetize. There is no infrastructure to pay for, because there is no infrastructure.
Completely. SpaceOne is a PWA: once loaded it runs with the network off, and you can keep it that way permanently. An air-gapped machine is a perfectly reasonable place to run it.
Export an encrypted backup and keep it somewhere else. Restoring it on a new machine takes the file and your password, nothing else. Clearing your browser data also wipes the vault, so make the backup before you need it.
Don't trust. Verify. The code is open, the algorithms are standard and public (AES-256-GCM, Argon2id, HKDF, BIP39), and the architecture gives us nothing to abuse: no account, no server, no telemetry.
Free · Open source · No sign-up
