Sealrepo
Sign inStart free
Automation

Back up your master key, the zero-knowledge way

Escrow means letting someone hold a sealed copy of something for safekeeping. Here, it uploads an encrypted blob of your project master key to sealrepo.dev so you can recover after a lost laptop — without us ever being able to read it. The blob is wrapped with a key derived (via scrypt) from a SEPARATE recovery passphrase you choose — not your project passphrase. We see ciphertext, never the key.

Should I turn this on?
Turn it on if you ever work across multiple machines, lose laptops, or worry about being locked out by a hardware failure. Don't turn it on if you'd rather have zero server-side state about your project and only ever recover from your printed recovery code.

How it works

The project must be linked first (sealrepo link). When you run sealrepo escrow enable, the CLI:

  1. Asks for your project passphrase once, just to prove you can unlock the vault and to load the master key locally.
  2. Asks you to choose a separate recovery passphrase— this is the one you'll type on a new machine. Store it somewhere different from your project passphrase.
  3. Derives a wrapping key from that recovery passphrase using scrypt (N=2¹⁷, r=8, p=1) and a fresh random salt.
  4. Encrypts your project master key with AES-256-GCM under that wrapping key, and uploads only the ciphertext + scrypt salt to sealrepo.dev. We never see either passphrase, we never see the master key.

Anyone (including us) who steals the blob still can't read it without your recovery passphrase, and brute-forcing scrypt at those parameters on a strong passphrase costs roughly the GDP of a small country.

  1. Enable escrow

    From inside a linked repo:

    Enabling escrow
    $sealrepo escrow enable
    First, prove you can unlock this vault.
    Project passphrase: ●●●●●●●●●●●●
    Now choose a separate recovery passphrase for cloud escrow.
    Recovery passphrase: ●●●●●●●●●●●●●●●●
    Confirm recovery passphrase: ●●●●●●●●●●●●●●●●
    ✓Cloud escrow enabled.
    Recover on a new machine with: sealrepo escrow recover

  2. See the status in the dashboard

    On the project overview page, the Cloud key escrow card shows what we hold: the fingerprint (a short ID derived from the encrypted blob — it identifies the blob without revealing anything about the key), when it was uploaded, which machine uploaded it, and a button to disable it.

    We only show metadata
    The card doesn't show your key — we don't have it. It only shows the public fingerprint of the ciphertext, the timestamp, and the hostname you uploaded from (so you can spot uploads from machines you don't recognize).

  3. Recover on a new machine

    New laptop, fresh OS, you've lost the old one. You install & sign in again, then clone the repo (that brings the encrypted vault and keystore back from git) and run recover with your recovery passphrase:

    On the replacement machine
    $git clone [email protected]:acme/billing.git
    $cd billing
    $sealrepo escrow recover
    Recovery passphrase: ●●●●●●●●●●●●●●●●
    ✓Recovery successful. Session cached — you can now run `sealrepo unlock`.
    $sealrepo unlock
    ✓unlocked 137 files
    Recover restores the key, not the repo
    Escrow brings back the master key (it caches an unlock session). The encrypted files and keystore come from git, so you must clone the repo first — recover on a directory with no vault will tell you to clone. If the recovery passphrase is wrong (or the blob was tampered with), decryption fails cleanly; scrypt is deliberately slow, so each attempt costs a second or two.

  4. Disable escrow

    If you ever want us to forget the blob entirely — for compliance, paranoia, or because you've switched to a different recovery scheme:

    Disabling escrow
    $sealrepo escrow disable
    ✓Cloud escrow disabled. Server-side blob deleted.
    Keep your recovery code
    Deleting the escrow blob is immediate and permanent. Make sure you still have your recovery code (or project passphrase) somewhere safe before you disable — escrow was your cross-machine safety net.

    You can also click Disable escrow on the project overview card — same effect.

Next
Passphrase rotation & recovery code
→