Our live vault cryptography is open source

Our live vault cryptography is open source.

The client-side library that encrypts your live vault in the browser is public at TrueWear/heirvault-crypto and on npm as @heirvault/crypto under Apache-2.0. You can read the algorithms, run the package, and check what we ship against what the product claims.

This post is the announcement and the trust boundary. It complements the security page. It does not replace it.

The open library covers the live vault crypto path that runs in your browser before upload:

• Passphrase-derived key material (Argon2id)
• AES-GCM sealing for vault contents
• Vault key wrap and recovery helpers used for the owner live vault

HeirVault's live vault is protected by end-to-end encryption and encrypts in your browser before upload. That means HeirVault stores ciphertext and cannot decrypt your live vault. The library is the auditable implementation of that browser-side path.

The full product is not open source. Application code, Convex backends, assisted-delivery escrow, account auth, and operational services stay private.

Assisted delivery is not in the library. HeirVault-assisted delivery stores a protected handoff key and transfers it to the beneficiary account after claim. That path is not end-to-end to the beneficiary alone. Invite now and owner-shared beneficiary passphrase delivery keep the handoff key off HeirVault servers. Those product choices are documented on /security; they are not part of @heirvault/crypto.

It is not third-party audited yet. The cryptography is standard rather than novel. Opening the library makes independent review possible. It is not a substitute for an audit that has not happened.

For an end-to-end product, the useful trust question is not "do you use encryption?" It is "can someone who is not you verify the client-side claims?"

Publishing the live vault library answers that for the path where we say plaintext never reaches our servers as a routine step. Readers can inspect the package, pin a version, and compare it to the security page instead of taking a marketing badge on faith.

1. Read the repo README and the PUBLIC module list.
2. Confirm assisted delivery and server escrow are out of scope for the package.
3. Compare the claim on /security to the code you can see.
4. Treat "not audited yet" as a real boundary until an independent review exists.

If you want the threat-model backdrop for client-side encryption generally, start with What client-side encryption actually protects.

• GitHub: TrueWear/heirvault-crypto
• npm: @heirvault/crypto
• Product trust boundary: /security