Cold-Start Recovery Vault Builder

🔑 1. Disaster Recovery Passphrase (Master Key)

Memorized Diceware phrase (≥6 words, or 8 generated words for ~80 bits entropy). This decrypts your vault.

0 / 6 words 0 / 20 chars 0 unique Entropy: Incomplete

📦 2. Credential Cards (Modular Architecture)

Add, customize, and arrange multiple password managers, single-use backup codes, seed phrases, TOTP seeds, or custom keys.

+ Add Card:

⚙️ 3. Vault Configuration & Dead-Drop DNS

Settings for staleness detection and the secondary RFC 1035 DNS TXT dead-drop.

Recovery DNS Domain

Canary Code (Quick 2SV Verification)

Stale After (Months)

HTML Template Status

✓ Default embedded

✓ Recovery Vault Encrypted Successfully!

PBKDF2-SHA-256 (600,000 rounds) • AES-GCM-256 • Verified round-trip decryption

🌐 Step 1: Deploy to Edge Hosting (Cloudflare / Netlify / Vercel)

Host your hardened single-file recovery terminal at https://sos.yourdomain.com

Option A: Direct Upload via Web Dashboard (Zero Git Secrets)

Log into the Cloudflare Dashboard.
Navigate to Workers & Pages → Select your Pages project (or click Create application → Pages → Direct Upload).
Create an empty folder, place the downloaded index.html (and _headers) inside, and drag it into the dropzone.
Click Deploy site. Your vault is live worldwide on Cloudflare's Anycast Edge!

Option B: CLI Direct Deploy

./scripts/deploy.sh payload.json --provider cloudflare --project identity-recovery

📡 Step 2: Update DNS TXT Dead-Drop (Cloudflare, Route53, or Any DNS)

Secondary fallback queryable via DoH if your web URL is unreachable.

In your DNS provider (such as Cloudflare DNS, AWS Route 53, etc.), add or update the following TXT record in your domain zone: