ID Recovery Kit is an open-source, cold-start disaster-recovery protocol. It securely encapsulates your password manager emergency tokens, 2SV backup codes, and live TOTP authenticators inside an offline AES-GCM-256 encrypted vault that you can unlock on any borrowed browser using a memorized Diceware passphrase.
No repository cloning or developer environment required. Choose the browser GUI or the 1-command automated CLI.
Ideal for rapid disaster-preparedness setup. Split-pane workspace with live decrypted terminal preview, running entirely inside your browser's private memory.
index.html and drop it directly into Cloudflare Pages or Netlify Drop.
Automates encryption, test verification, edge hosting upload, and DNS TXT dead-drop synchronization with zero repository cloning.
npx from GitHub without cloning repo files.
Engineered for high-stress disaster scenarios when you have zero secondary devices and zero access to your primary email or phone.
Use our air-gapped web studio to configure your password manager tokens, backup codes, and seeds with live terminal preview. All encryption executes strictly in local browser RAM.
Choose a Diceware passphrase (minimum 6 words, 8 words recommended for ~80 bits of entropy). Your passphrase is never stored on disk, never sent over a network, and known only to your human memory.
In a crisis, borrow any computer or phone worldwide. Access your self-hosted recovery page (or query your DNS dead-drop via DoH), type your 6–8 words, and unlock your identity.
Built from first principles to withstand physical device loss, untrusted public terminals, and hosting censorship.
Single-file HTML running pure browser WebCrypto. Zero external CDNs, zero NPM packages in production, zero telemetry, and a strict default-src 'none' CSP.
PBKDF2-HMAC-SHA256 with 600,000 iterations (exceeding OWASP recommendations by 300,000 rounds) paired with AES-GCM-256 authenticated encryption.
If your web hosting is blocked or censored, your encrypted vault is queryable as an RFC 1035 DNS TXT record via Cloudflare & Google DNS-over-HTTPS (DoH).
Zero storage persistence (no-store, zero localStorage). Pressing Escape x3 flushes all DOM secrets instantly, and the clipboard auto-scrubs after 45 seconds.
Estimate brute-force resistance against high-performance GPU clusters when protected by 600,000 rounds of PBKDF2.
Common questions regarding threat models, hosting safety, and disaster recovery mechanics.
window.crypto.subtle). All key derivation, encryption, and decryption happen strictly in local RAM without transmitting any data over a network.
localStorage, zero cookies). The client automatically scrubs the system clipboard after 45 seconds, and pressing Escape x3 triggers an instant panic purge that zeroes DOM memory. Once you recover on a safe device, simply rotate your master keys.
/app/ to compile your credentials into an encrypted index.html file, then drag and drop it directly into Cloudflare Pages Direct Upload or Netlify Drop. If you prefer the terminal, you can run the 1-command setup wizard directly via npx github:janhrabcak/identity-recovery with zero repository cloning.