What will happen to your accounts when you are gone? Secret Key splits the master password to your password vault among trusted individuals. No single person knows it on their own - only together, at the right moment, can they reconstruct it.

Until one of the "trusted individuals" dies or perhaps is captured and imprisoned by a <hostile regime>, including our own ?

Related browser-based secret splitting tools -- https://bs.parity.io/ -- http://passguardian.com/ -- https://iancoleman.io/shamir/ -- but those do not store a pw vault file.

Secret Key is a self-hosted emergency access system for password databases. It splits the master password into shares distributed among trusted people. The idea came to me during a trip in the mountains. I started wondering what would happen to all my online accounts if I didn't come back.

It uses Shamir Secret Sharing via secrets.js, compatible with iancoleman.io/shamir. Trusted people authenticate via SMS, and once enough shares are provided, the master password is reconstructed in the browser. A 48-hour download lock gives the owner time to react using a Panic Button that blocks the download.

Some limitations: the project has not undergone an independent security audit, SMS relies on an external provider, and the 48-hour lock delays downloading the vault but cannot prevent someone with enough shares from mathematically reconstructing the secret. The demo UI is currently only in Polish.

I'd appreciate feedback on the threat model: what attack scenarios or security assumptions am I overlooking, particularly regarding collusion between trusted participants?

Project: https://secretkey.website Demo: https://app.secretkey.website Documentation: https://secretkey.website/docs/ GitHub: https://github.com/mateuszkarpierz/secret-key