Digital legacy vault: encrypted messages for a trusted executor

Two independent pieces. First, the vault itself lives only on this device, encrypted with your own passphrase. Second, the release package is a plain file you export and hand to a trusted executor in advance. That file contains every message encrypted with a separate release passphrase. When you stop checking in, the executor opens the package with the release passphrase and distributes the messages. The whole thing runs on trust in one person, exactly like a sealed envelope left with a lawyer.

The vault on this device becomes unreadable. The release package you already exported is unaffected and can still be opened by the executor with the release passphrase. That is why it is important to export the release package as soon as the messages are written.

The exported release package becomes unreadable. The vault itself is unaffected, so you can export a new package with a new release passphrase. This is why you should give the release passphrase to your executor as soon as you export the package, not later.

No. It exists only in the tab during the export and inside the executor encrypted messages. It is never written to the vault or to disk.

It is a check-in timer, not an automatic trigger. Browsers cannot fire a message to someone else on a schedule with no server involved. What this tool does is track your check-ins and warn you when the deadline approaches, so you know to renew it. If you miss the deadline, the executor opens the file you already gave them.

The deadline date is stored in plain text inside the release package. When the executor loads the file, they see the deadline and a clear message about whether it has passed. Use the instructions text field to write out exactly what you want them to do.

No. The instructions are stored unencrypted in the release package. Anyone who has the package can read them. The instructions should tell the executor how to reach each recipient, how to open the package, and any practical details. They must not contain the release passphrase or any account credentials.

Both should be at least 12 characters. The release passphrase especially: it protects the messages after you are gone, and the executor may only open it once. Use a long phrase with numbers and symbols, and give the executor a written copy. Both passphrases should be different from each other and from any other password you use.

Anywhere they already keep important documents. A law office, a safe deposit box, an encrypted USB drive, or a password manager attachment. The package is already encrypted, so it is safe even in less secure storage. What matters is that the executor can find it when they need it.

Yes, as often as you like. Each export creates a fresh file with fresh encryption. Export a new one whenever you add or edit messages, and give the new file to your executor. Keep using the same release passphrase so you only have to give them one secret.

Only one vault per browser profile. If you want separate vaults for separate purposes, use separate browser profiles or separate devices. Each vault is independent and has its own passphrase and release package.

There is no hard limit. The messages are encrypted individually, so a vault with 100 recipients and 300 messages is still only a few hundred kilobytes. The practical limit is how much you feel comfortable managing.

Yes, the page and the crypto work on modern mobile browsers. On iOS, IndexedDB can be cleared for sites you have not visited in a while, so export a fresh release package after every major edit and store it somewhere off the device.

The vault is encrypted with AES-256-GCM using a key derived from your vault passphrase via PBKDF2-SHA256 at 250,000 iterations. Each message in the release package is encrypted the same way, using a key derived from the release passphrase with a fresh salt and IV per message. This is the same cipher and KDF used by the Encrypted Notes tool.

Yes. On the same page, switch to the I received a release package tab, load the file, and enter the release passphrase. You will see the messages exactly as the executor will see them.

No. A will has specific legal requirements in every jurisdiction: witnesses, signatures, notarisation, registration. This tool stores messages and instructions; it is not a legal instrument. Use it alongside a proper will, not instead of one.

Just edit the message in the vault, then export a new release package and give the new file to your executor. The old file can be destroyed. Always re-export after any change.