Docs / StarVault guide / Defense-in-Depth Security & True Local 2FA
Defense-in-Depth Security & True Local 2FA
- Argon2id Key Derivation: Derived using RFC 9106 recommended parameters (
m=64MB,t=3,p=4,len=32). - True Local 2FA (QR Code Keyfile): Fuses your Master Password with an offline 256-bit random QR Code Keyfile (
keyfile.png). Unlocking requires both knowledge (Master Password) and possession (physical QR keyfile). - AES-256-GCM Field & File Encryption: All passwords, tokens, private keys, notes, and file BLOBs are encrypted with unique 12-byte random nonces and 16-byte authentication tags.
- Canary Validation: Verifies authentication without ever storing plaintext passwords or hashes on disk.
- In-Memory Protection: Cryptographic key bytes in memory are zeroed upon lock or exit.
- 100% Offline & Portable: Single standalone SQLite database (
starvault.db).
Updated 2026-10-31