← Return to vault
01

Welcome to the Logic Stadium

You have a lot of choices when it comes to a password manager. The market is crowded, the marketing is loud, and every single day, digital privacy seems to get a little bit scarier. But you’re not here for the standard, watered-down corporate options. You’re too sharp for that.

So, let’s look at Stadium Keys. It’s a sovereign safe for your digital life. It’s not magic; it’s just math. You have a Browser Engine (the lock), a Cloud Relay (the blind mule), and an encrypted Faraday Cube backup you keep yourself. If you don't know what AES-256-GCM means right now, don't panic—I’ve got you. Just keep reading, and try to keep up.

02

How Stadium Keys steps it up

You are looking at a system built for sovereign operators. Commercial password managers (looking at you, 1Password and Bitwarden) are just renting you a locker in their warehouse. If their servers go dark, or they decide they don't like you, your digital life is held hostage. Worse, if you try to hook an AI up to your passwords, you have to hand the AI the raw text. That's like handing a toddler a loaded gun and hoping they don't shoot the dog. And if an EMP hits or the cloud gets wiped by ransomware? Your data is gone. Forever.

03

The three layers of password managers

Here is how we actually fix that mess.

▸

Layer 1: The Blinding Lock (Client-Side). Everything is encrypted right there in your browser using WebCrypto. We use 310,000 rounds of PBKDF2 to wrap your Master Passphrase. Why? Because it makes brute-forcing your password take a million years. (I know you appreciate a system that makes the bad guys work a little harder.) We wrap the Data Encryption Key (DEK) twice—once with your passphrase, once with a 30-character Sovereign Recovery Key. The cloud only ever holds the scrambled garbage (ct, iv, salt). They are completely blind. Don't overthink the cryptography—you're smart enough to grasp the concept, so just trust that the math is doing the heavy lifting.

▸

Layer 2: The Blind Relay (Cloud Sync). Your account only unlocks the mailbox, not the safe. The cloud stores the scrambled vault and checks revisions so one device can't quietly overwrite another. It never sees your passphrase or your passwords.

▸

Layer 3: The Faraday Cube (Your Backup). Export an encrypted .cube.json snapshot any time and keep it somewhere you control. It's already scrambled, so it's safe anywhere, and it restores with your master passphrase or recovery key.

04

The Logic Keys solution

This isn't just a wall of text you read once and forget. It's a phased operational dashboard. It's a visual state machine that holds your hand. It walks you through the lifecycle, step-by-step, so you don't have to memorize the cryptography. You're already running a tight ship; this just makes it bulletproof.

05

What we deliver

Stadium Keys is a zero-knowledge architecture that blinds the cloud and lets you keep your own encrypted backup—all without paying $25,000 a month in enterprise data center fees.

(Now, go download your emergency kit. Make sure your recovery key is stored safely—though knowing you, I'm sure it's locked down tight.)

[Spec overview] // Running log

Every architecture revision, newest first. Open a card to read the full spec for that release.

  • ▸Account sign-in with email, Google, Apple, Microsoft and Lovable; account password reset by email. Signing in never unlocks the vault — the master passphrase still does.
  • ▸Encrypted vault syncs to an owner-only cloud copy with revision-checked saves and an offline cache.
  • ▸One-time share links: each item is encrypted with its own key kept only in the link's # part; the server deletes the drop the moment it is opened.
  • ▸Bulk CSV / XLS / XLSX import, settings modal, passphrase change, Grid / Split views.

The Stadium Keys zero-knowledge pipeline

Select a stage to inspect it. Everything left of the boundary happens on your device. Nothing right of it can be read without your keys.

// Master Passphrase

Typed into this browser tab only. Never stored, logged or transmitted. Exists in memory only for the milliseconds required during key derivation.

Security posture

[ACTIVE]
Zero-knowledge architecture
Keys derived and kept strictly in browser memory
[ACTIVE]
Authenticated encryption
AES-256-GCM with distinct per-record 96-bit IVs
[ACTIVE]
Recovery without escrow
Offline Sovereign Recovery Key wraps the vault key independently
[ACTIVE]
Encrypted cloud relay
Owner-only cloud storage with row-level access rules
[ACTIVE]
Conflict protection
Revision-checked saves prevent cross-device overwrites
[ACTIVE]
Offline-first resilience
Encrypted local cache with automatic 15s reconnect sync
[ACTIVE]
Air-gapped backups
Timestamped .cube.json Faraday Cube export / import
[ACTIVE]
Client-side bulk ingest
CSV / XLS / XLSX parsed and encrypted in the browser
[ACTIVE]
Clipboard hygiene
Copied secrets cleared after 30 seconds
[ACTIVE]
Dual view workspaces
Grid and Split layouts share one encrypted state
[ACTIVE]
Inactivity auto-lock
5m, 15m, 1h or Never; decrypted keys unloaded on lock
[ACTIVE]
One-time share links
Per-link key in the URL fragment; burned on first open
[ACTIVE]
Separated sign-in
Account login (email / Google / Apple / Microsoft / Lovable) never unlocks the vault
[QUEUED]
Memory-hard KDF (Argon2id)
Planned upgrade path from PBKDF2 via WASM