Quanta — Post-Quantum Password Vault

Quanta is a client-side password vault that runs entirely in the browser. Your vaults are files you own — there is no server, no account, and no database. All cryptography is post-quantum: ML-KEM-1024 key pairs, Argon2id passphrase derivation, and ChaCha20-Poly1305 AEAD.

• Try it: https://quanta.jesed.dev/
• Crypto engine: qarmor (Rust → WASM)
• CLI companion: qarmord
• See TUTORIAL.md for a guided walkthrough.

Usage

Open https://quanta.jesed.dev/ in a browser.

• Create a vault: pick one of three methods — keypair with passphrase (recommended), unprotected keypair, or passkey (WebAuthn PRF). The app generates a fresh ML-KEM-1024 key pair and downloads an identity file (.qarmor-id) plus an empty vault (.qarmor).
• Unlock: drop the .qarmor-id and vault files, enter your passphrase (or paste the raw secret hex for an unprotected key), or tap your passkey.
• Manage entries: add, edit, delete, search, reveal / copy passwords, generate new ones (CSPRNG or diceware). Save & download the vault whenever you change it.
• Everything runs locally in WASM. Nothing is uploaded anywhere.

Security

Quanta enforces no passphrase-only encryption. A passphrase always wraps an ML-KEM-1024 secret key. The vault is encrypted with a Qarmor v3 recipient envelope (ML-KEM-1024 + HKDF-SHA-256 + ChaCha20-Poly1305).

Unlock method comparison

Method	Post-quantum	Recovery	Notes
Keypair + passphrase (recommended)	Yes	Identity file + passphrase	Argon2id m=64MB, t=3, p=4. Pubkey fingerprint matches qarmord.
Unprotected keypair	Yes	Raw secret-key hex	No passphrase wrapping. App warns explicitly. Use with caution.
Passkey (WebAuthn PRF)	Yes	Passkey on your device	Requires PRF-capable authenticator. Nothing stored outside the device.

Auto-lock after 5 minutes idle. Clipboard auto-clears after 30 s. beforeunload warns on unsaved changes.

See SECURITY.md for the full security boundary and reporting.

Interoperability

• .qarmor-id identity files export a qarmord-compatible .pub public key.
• .qarmor vaults use the Qarmor v3 envelope — identical wire format to qarmord encrypt --recipient.
• Decrypt a Quanta vault with qarmord:

  qarmord decrypt vault.qarmor -i identity.qarmor-id -o vault.json

• Verify a fingerprint: qarmord identity identity.qarmor-id, or in-app.

See docs/FORMAT-V3.md for the wire format.

Develop

./dev dev        # Vite dev server
./dev check      # svelte-check (types + a11y)
./dev build      # static production build -> ./build
./dev preview    # preview the production build
./dev wasm       # rebuild the WASM bundle from qarmor source
./dev deploy     # wrangler pages deploy ./build

Requires Node 20+ and npm. The WASM bundle is committed under static/pkg/; rebuild it only when the qarmor dependency changes.

Deploying

Quanta is a static site. Deploy ./build to any static host, or use Cloudflare Pages with the included wrangler.jsonc:

./dev build
./dev deploy

Security and contribution

Quanta runs locally in your browser — no upload, no sync, no account. Browser extensions, malware, screenshots, and device compromise are outside its security boundary. See SECURITY.md for reporting vulnerabilities.

Contributions are welcome. Read CONTRIBUTING.md and CODE_OF_CONDUCT.md before opening a pull request.

License

MIT. See LICENSE.