🔒 Zero Runtime Dependencies • 600,000 PBKDF2 Rounds • MIT Open Source

When All Your Devices Are Gone, How Do You Recover Your Identity?

ID Recovery Kit is an open-source, cold-start disaster-recovery protocol. It encapsulates your password manager emergency tokens, single-use 2SV backup codes, seed phrases, and live TOTP authenticators inside a self-contained, offline AES-GCM-256 encrypted terminal that you can unlock on any borrowed browser with nothing more than your memory.

🚀 Launch Web Vault Builder 💻 CLI Quickstart ⭐️ Star on GitHub

~/identity-recovery — deploy.sh

$ ./scripts/deploy.sh payload.json --provider cloudflare

[1/7] Running pre-flight security checks...

✓ Valid JSON payload with required credentials.

[2/7] Enter 6-word Diceware passphrase: ******

✓ Sufficient Diceware entropy detected (~77.5 bits).

[3/7] Encrypting with PBKDF2-SHA256 (600,000 rounds) + AES-GCM-256...

✓ Zero Git Persistence: Staged in ephemeral staging directory.

[4/7] Synchronizing Cloudflare DNS TXT dead-drop (sos.yourdomain.com)...

✓ DNS TXT record published worldwide. Queryable via DoH anywhere.

🚀 Recovery terminal live worldwide at https://sos.yourdomain.com

The Physical Disaster Problem

Why Traditional Password Managers Fail in a Crisis

Modern password managers are fantastic, until physical disaster strikes. What happens when you are stranded with zero primary devices?

The Cold-Start Catch-22

You are traveling and your backpack with your phone, laptop, and hardware security key (YubiKey) is stolen.

You walk into a hotel business center or library. You know your master password, but your password manager requires an emergency secret key or token (which was on your laptop), and your primary email account requires a hardware key or 2SV prompt (which was on your phone).

Without your devices, you cannot log in. Without logging in, you cannot retrieve your devices.

1
Walk up to any browser Navigate to your recovery URL (or query the DNS dead-drop via DoH).
2
Enter your 6-word Diceware passphrase PBKDF2 derives the key locally in WebCrypto with 600,000 rounds. No backend server ever sees your passphrase.
3
Restore access immediately Copy your password manager emergency credentials, generate live TOTP codes, and use 2SV backup codes to sign in.

🔒

600,000 PBKDF2 Iterations

Key derivation exceeds OWASP recommendations by 300,000 rounds. Encrypted via AES-GCM-256 with 96-bit CSPRNG initialization vectors.

📡

DNS Dead-Drop Fallback

If your web domain is blocked, censored, or unreachable, your ciphertext is queryable as a DNS TXT record via Cloudflare & Google DoH.

🛡️

Zero Runtime Dependencies

Strictly self-contained single-file HTML. No external npm libraries, zero third-party CDNs, and a strict Content Security Policy (CSP).

🌐

Multi-Provider Edge Hosting

Deploy with automated header parity across Cloudflare Pages, Netlify, and Vercel with no-store caching and clickjacking protection.

⚡

Live TOTP & QR Engine

Built-in WebCrypto HMAC-SHA1 engine generates 30-second live 2FA codes directly in browser, with offline QR code generation for mobile re-enrollment.

🧹

Panic Button & Auto-Scrub

Pressing Escape x3 instantly flushes all decrypted secrets from DOM memory. System clipboard auto-clears after 45 seconds.

Developer Quickstart

Deploy via Automated CLI

Automate encryption, verification tests, and zero-persistence direct edge deployment in seconds.

# 1. Clone repository
git clone https://github.com/janhrabcak/identity-recovery.git
cd identity-recovery

# 2. Copy sample payload and populate credentials
cp templates/sample-payload.json payload.json
chmod 600 payload.json
vim payload.json

# 3. Direct Edge Upload to Cloudflare Pages (Zero Git Secrets)
./scripts/deploy.sh payload.json --provider cloudflare --project identity-recovery