Vault and sessions
- Create vaults with a custom master passphrase and optional hint.
- Choose an idle auto-lock interval from one minute through one hour, or never.
- Use Ctrl+L for an emergency lock and rotate the master passphrase in place.
PV-01 · WhyireCrypt
A portable vault for Windows. Your secrets stay local.
WhyireCrypt is an offline credentials vault for Windows 10 and 11 (x64). It combines a Rust and Tauri desktop runtime with a Svelte interface to manage passwords, contacts, and structured secrets in an encrypted local vault.
The supplied build is a portable single binary, designed for zero network egress: no sockets, telemetry, or remote assets.
Built for local storage and controlled access
The desktop interface communicates with the native Rust runtime over Tauri IPC. Vault changes are written atomically, and the KDF profile is retained in the encrypted vault header.
| Target platform | Windows 10 / 11 (x64) |
|---|---|
| Distribution | Portable single binary: WhyireCrypt-Portable-Vault.exe |
| Application stack | Rust 2021, Tauri v2, Svelte 5, TypeScript 5.7 |
| Key derivation | Argon2id v0x13; default 64 MiB, 3 passes, 4 lanes |
| Encryption | ChaCha20-Poly1305 (IETF), 256-bit key, 96-bit CSPRNG nonce |
| Memory handling | zeroize::ZeroizeOnDrop for keys, plaintext buffers, and secrets |
| Network behavior | Zero-egress design: no sockets, telemetry, or remote assets |
| Clipboard | Windows isolation flags and 30-second auto-clear |
| Vault file limit | 32 MiB |
Argon2id profiles also include Paranoid (256 MiB, 4 passes, 4 lanes) and Quick Unlock (32 MiB, 2 passes).
What the vault can do
Passwords, contacts, and structured secrets
- Store passwords with URL, username, notes, and an optional TOTP authenticator.
- Keep encrypted contact records and purpose-built secret forms for finance, identity, infrastructure, networks, and more.
- Create custom key-value records with typed fields.
TOTP and password generation
- Generate RFC 6238 codes using SHA-1, SHA-256, or SHA-512, with six- or eight-digit codes and 30- or 60-second steps.
- Import standard otpauth://totp/ URIs.
- Generate random passwords or configurable multi-word passphrases and view an entropy estimate.
Clipboard and credential hygiene
- Clear copied secrets from the clipboard after 30 seconds and set Windows clipboard-history and cloud-sync exclusion flags.
- Audit for reused, weak, and stale passwords and accounts without two-factor authentication.
Encrypted backup and recovery
- Export encrypted .whyirecrypt-backup archives.
- Import backups with size validation up to 33 MiB and verify authentication before replacing vault data.
- The vault file itself has a 32 MiB hard size limit.