VantaLock — Absolute Privacy. Zero Cloud.

What is AES-256-GCM and How It Works

AES-256-GCM (Advanced Encryption Standard with 256-bit key in Galois/Counter Mode) is the gold standard for authenticated symmetric encryption used by governments and high-security institutions worldwide.

• 256-bit Key Length: Provides 2^256 possible key combinations, making brute-force attacks physically impossible with current and foreseeable computing power.
• Authenticated Encryption (GCM): Unlike standard AES modes, Galois/Counter Mode calculates a 128-bit authentication tag alongside the ciphertext. Any tampering, bit-flipping, or data corruption is detected immediately before decryption is attempted.
• Unique Initialization Vectors (IVs): Every single entry and file attachment is encrypted with a fresh, random 96-bit IV, ensuring duplicate plaintexts generate completely different ciphertexts.

Key Derivation via Argon2id

Your master password is never stored anywhere on disk or in the cloud. Instead, VantaLock uses Argon2id (winner of the Password Hashing Competition) to derive the 256-bit AES key on demand.

• Memory-Hard Execution: Configured with 64 MB of RAM allocation per derivation to defeat GPU and ASIC accelerated cracking attempts.
• Cryptographic Salt: Combined with a 128-bit random salt stored locally to completely eliminate pre-computed rainbow table attacks.
• RAM Isolation: The derived key lives exclusively in RAM during your session and is instantly purged on lock or sleep.

Encrypted Local Backups & RAM Protection

Your data security extends through the full lifecycle of your session, ensuring zero remnants remain when the vault is locked.

• Local JSON Export & Import: Easily backup your entire encrypted vault to an offline USB or external hard drive. Backups remain fully encrypted with your master key.
• Auto-Lock & Clipboard Scrubbing: Inactive sessions automatically lock and derived keys are zeroed out in memory. Sensitive items copied to the clipboard are purged automatically after 30 seconds.

VantaLock's runtime engine enforces low-level operating system protection mechanisms across all desktop platforms to maintain absolute data integrity and prevent unauthorized memory inspection:

• RAM Memory Lockdown (mlock / VirtualLock): Key derivation buffers created via Argon2id are explicitly pinned in physical RAM memory using system calls to prevent sensitive cryptographic material from being written to unencrypted swap space or paging files.
• Zero-Trace RAM Scrubbing: Master keys and temporary AES-256-GCM cipher contexts are active strictly during operation and are deterministically overwritten with cryptographically random bytes before memory deallocation.
• Air-Gapped Operation: Designed to run seamlessly in completely offline, network-isolated environments (including live USB operating systems like Tails or Qubes OS) with zero external library or runtime network calls.

What is VantaLock?

VantaLock is an independently developed desktop vault application engineered to give individuals complete ownership over their sensitive data. Built on a strict zero-cloud architecture, VantaLock ensures that your files, credentials, and encrypted compartments reside exclusively on your local hardware.

Our Philosophy & Architecture

Modern cloud services expose private data to third-party server breaches, forced updates, and continuous telemetry tracking. VantaLock eliminates these vulnerabilities by running completely offline. All vault encryption is performed locally using military-grade primitives—including AES-256-GCM authenticated encryption, Argon2id password hashing, and standard 256-bit BIP-39 mnemonic key generation.

Operator & Development

VantaLock is engineered, maintained, and operated by an individual developer as an independent software security project dedicated to user privacy and digital sovereignty. The codebase is open for public inspection on GitHub, ensuring full cryptographic transparency without hidden tracking scripts, remote backdoors, or analytics collection.

What if I lose my password or recovery seed?

If you lose both your master password and your 24-word recovery seed, your data is permanently lost. Because VantaLock runs completely offline on your device, there are no password reset links, backdoors, or support overrides to help you regain access. Always save your 24-word recovery seed offline before storing sensitive files.

Where is my encrypted vault file stored on my disk?

Can VantaLock run completely offline?

Yes. Beyond the brief 1-time license activation check upon initial launch, VantaLock requires zero internet connectivity and can operate indefinitely in air-gapped environments.

Can I use my license on multiple devices?

No. Each license key is strictly bound to a single device hardware installation at a time. To run VantaLock on a different computer, you must transfer your license. Attempting concurrent activation on multiple machines will invalidate the key.

What happens if I reinstall VantaLock or switch computers?

What information does the license activation check send?

The initial 1-time activation check transmits only your purchased license key string and an anonymous hardware device fingerprint. No personal identity details, vault contents, passwords, or telemetry data are collected or transmitted. This check connects directly to Lemon Squeezy's secure API.

Can I export or migrate my data to another password manager?

No. VantaLock exports encrypted local JSON backups specifically for restoring VantaLock vaults. Due to custom zero-knowledge AES-256-GCM encryption and specialized multi-vault compartment schemas, exports are not directly compatible with third-party password managers like 1Password or Bitwarden.

How do I update VantaLock?