MirrorKey
Provider mode: DEMO PROVIDER

LOCAL VAULT / CRYPTOGRAPHIC PROOF

Your appearance keys live here—not in every store.

This route performs real AES-GCM encryption in your browser and persists only authenticated ciphertext in IndexedDB. Synthetic demo images are used so no personal photo is needed.

ASSET PACKAGE

Face Key

EMPTY
NO ASSET
BYTES STORED
—
PLAINTEXT IN IDB
NO
IV
—
AAD BOUND
—

ASSET PACKAGE

VTO Key

EMPTY
NO ASSET
BYTES STORED
—
PLAINTEXT IN IDB
NO
IV
—
AAD BOUND
—

IMPLEMENTED IN THIS DEMO

Inspect the cryptographic contract.

ENCRYPTION
AES-256-GCM
KEY DERIVATION
PBKDF2-SHA-256
ITERATIONS
600,000
KEY EXPORTABLE
NO
NONCE
12 random bytes / asset
SALT
16 random bytes / asset

Production passkey PRF support remains a deployment gate; this public route demonstrates the documented unlock-phrase fallback and never claims hardware binding.