home/cipher/razhan-vault

razhan-vault

zero-knowledge, post-quantum password manager · a WarFi project

razhan-vault is WarFi's terminal-based password manager, built on the bench's guiding rule: a vault is only trustworthy if you can understand how it protects you. It keeps your secrets under modern, post-quantum-aware cryptography, with an architecture designed so that the vault itself never learns your master password. For anyone who has wondered what a cloud password manager actually does with their data, this is the version where you can read the answer.

01A vault you can read

A password manager asks for enormous trust: it holds the keys to everything. razhan-vault earns that trust the hard way, by being understandable and by being built so that even a full compromise of where the vault is stored yields nothing usable. The master password never leaves your machine, and the stored vault is, without it, just noise.

» Terminal-first: fast, scriptable, and nothing hidden behind a GUI.

» Zero-knowledge: the key is derived locally; the vault at rest is ciphertext only.

» Post-quantum aware, so captured data stays safe against future quantum attack.

» Built to be audited, in keeping with the rest of the Cipher bench.

↑ contents

02The cryptographic stack

Each piece is chosen for a specific job, and together they cover key derivation, encryption, integrity, and post-quantum key protection.

» Argon2id turns your master password into the vault key on your own machine; Serpent-256 encrypts the contents; Kyber-1024 guards the key material against a future quantum adversary; Blake3 provides fast integrity.

03What zero-knowledge means here

The unlocking key is derived from your master password locally, with Argon2id, and is never stored or transmitted. The vault on disk is ciphertext; without your password it is unreadable noise. That is the difference between trusting a provider's promise and trusting mathematics: a breach of the storage yields nothing, because the thing that unlocks it was never there to steal.

The whole design still rests on one thing only you control: the master password. A long, unique passphrase is what makes the Argon2id and Serpent layers meaningful. Everything the rest of WarFi says about strong passphrases applies here most of all.

↑ contents

04How it is used

razhan-vault runs entirely in the terminal. You create a vault once under a master passphrase, then add, retrieve, and manage entries against it; the vault file can live anywhere, including untrusted storage, because it is only ever ciphertext. The exact command set is documented with each release.

» The design keeps the common actions fast and scriptable: unlock, fetch a secret to the clipboard or stdout, add or update an entry, and lock. Full command reference ships in the release README.

05Changelog

Kept short and honest; the project is in active development.

As with LORICA, binaries are posted signed; verify the signature before running, per the cipher guide.

↑ contents

Authorized use only. Use these tools and techniques solely on systems you own or have explicit written permission to test. Unauthorized access to computers, networks, or data is a crime in nearly every country, including the Philippines (RA 10175), the United States (CFAA), the United Kingdom (Computer Misuse Act 1990), and across the European Union (Directive 2013/40/EU). When in doubt, get permission in writing first. This is general information, not legal advice.