Verifiable delivery
Code integrity
A browser vault re-downloads its own code on every visit. We make that code verifiable: every build publishes the SHA-256 of each file plus one aggregate bundle hash, and this page re-hashes what your browser actually executed.
Live check on this tab
What this defends against
The realistic attack on any browser-delivered vault is not breaking the cipher — it is shipping one extra line of JavaScript that copies the master key at unlock time. Content Security Policy does not stop it, because that line would be same-origin code. Native apps answer this with signed binaries; we answer it with published per-file hashes, an aggregate bundle hash you can compare with other users, and an in-browser check that flags any script the manifest does not cover.
A targeted backdoor delivered to a single account is the hardest variant to detect. Because the bundle hash is deterministic for a given build, two people comparing this page catch it immediately.
Continuous verification, published in the open
Every page load re-hashes the code that actually ran and compares it to the fingerprint of the build we published. The verdict is shown on this page, so you can check at any moment whether the app in front of you is the app we shipped — and so can anyone else, from any device, without taking our word for it.
A verification result is only useful if it is trustworthy. Delivery layers legitimately alter what a browser receives — an edge cache still serving the previous build, a platform script added to the page, a browser extension. None of those is an attack, and treating them as one would lock you out of your own files: an outage, not security. So the two cases are kept strictly apart. Offline, a cache miss, or a deployment with no published manifest gives unverified. A positive mismatch is reported here, kept in the audit trail, and investigated — and your keys are still derived only in your browser, from your password, never on our side.
The remaining gap is honest to state: this check runs inside the same page it is checking, so it raises the cost of a targeted backdoor substantially without being the mathematical guarantee that browser-enforced Subresource Integrity on every chunk would give. That remains on our roadmap, and until it ships the manifest check does the work — and additionally catches injected scripts that SRI alone would not.