Zero-knowledge encryption

Quantum-safe encrypted notes and files.
No accounts, no logs.

How it works

01 |

Derive the password key

Your browser runs Argon2id on your password and PIM to derive a Key Encryption Key (KEK) seed. Strong passwords still matter.

Standard: PIM=100, Iterations=4, Memory=64MB. Paranoid: Iterations=6, Memory=128MB.

02 |

Add the ML-KEM layer

A deterministic ML-KEM-768 keypair is derived from the seed. A random Data Encryption Key (DEK) is wrapped via an ML-KEM shared secret, so plaintext keys never leave your device.

03 |

Encrypt in chunks

Notes and files are encrypted before upload with AES-256-GCM, using a random 256-bit DEK and unique per-chunk nonces for large files. The server stores only ciphertext.

Install

# From the project root:
cd reiven-cli
npm install
npm link

# Verify command:
reiven --help

Upload

# Upload a file (prompts for password):
reiven put secret.pdf

Password: *********

Access code: *** 80-94-86-60 ***
Download URL: https://reiven.io/download?id=b05b053a745aed1dfb
Delete URL: https://reiven.io/delete/b05b053a745aed1dfb/d8b97cbd72640936c9800b3289269f6f7274c7d631d7af6d
Expires at: 2026-02-27T07:02:58.120Z

Download

# Download by access code:
reiven get 80948660

Password: *********

Saved: /Users/reiven/Documents/secret.pdf