ID Recovery Kit is an open-source, cold-start disaster-recovery protocol. It encapsulates your password manager emergency tokens, single-use 2SV backup codes, seed phrases, and live TOTP authenticators inside a self-contained, offline AES-GCM-256 encrypted terminal that you can unlock on any borrowed browser with nothing more than your memory.
$ ./scripts/deploy.sh payload.json --provider cloudflare
[1/7] Running pre-flight security checks...
✓ Valid JSON payload with required credentials.
[2/7] Enter 6-word Diceware passphrase: ******
✓ Sufficient Diceware entropy detected (~77.5 bits).
[3/7] Encrypting with PBKDF2-SHA256 (600,000 rounds) + AES-GCM-256...
✓ Zero Git Persistence: Staged in ephemeral staging directory.
[4/7] Synchronizing Cloudflare DNS TXT dead-drop (sos.yourdomain.com)...
✓ DNS TXT record published worldwide. Queryable via DoH anywhere.
🚀 Recovery terminal live worldwide at https://sos.yourdomain.com
Modern password managers are fantastic, until physical disaster strikes. What happens when you are stranded with zero primary devices?
You are traveling and your backpack with your phone, laptop, and hardware security key (YubiKey) is stolen.
You walk into a hotel business center or library. You know your master password, but your password manager requires an emergency secret key or token (which was on your laptop), and your primary email account requires a hardware key or 2SV prompt (which was on your phone).
Without your devices, you cannot log in. Without logging in, you cannot retrieve your devices.
Type words separated by spaces to estimate security against offline brute-force attacks via PBKDF2 (600,000 rounds):
Key derivation exceeds OWASP recommendations by 300,000 rounds. Encrypted via AES-GCM-256 with 96-bit CSPRNG initialization vectors.
If your web domain is blocked, censored, or unreachable, your ciphertext is queryable as a DNS TXT record via Cloudflare & Google DoH.
Learn how it works →Store multiple password managers (1Password, Bitwarden, KeePassXC), BIP-39 12/24-word cryptocurrency cold storage seeds, and custom secrets.
Strictly self-contained single-file HTML. No external npm libraries, zero third-party CDNs, and a strict Content Security Policy (CSP).
Deploy with automated header parity across Cloudflare Pages, Netlify, and Vercel with no-store caching and clickjacking protection.
Built-in WebCrypto HMAC-SHA1 engine generates 30-second live 2FA codes directly in browser, with offline QR code generation for mobile re-enrollment.
Pressing Escape x3 instantly flushes all decrypted secrets from DOM memory. System clipboard auto-clears after 45 seconds.
Save the HTML file to a USB thumbdrive or paper printout. Functions 100% offline without needing an active internet connection.
When web browsing is blocked, firewalled, or edge CDNs experience an outage, your recovery vault remains accessible worldwide over raw DNS (port 53 UDP) and DNS-over-HTTPS (DoH).
Full graphical recovery terminal hosted on Cloudflare Pages, Netlify, or Vercel. Features client-side WebCrypto decryption, live 30-second TOTP generation, single-use 2SV backup code strikethrough tracking, and panic auto-scrubbing.
Completely decoupled from web servers and HTTP availability. Your encrypted ciphertext is stored directly in DNS Anycast nameservers worldwide. Queryable from any minimalist terminal using standard tools (dig, nslookup, or DoH JSON APIs).
Fetch and clean your encrypted ciphertext from any terminal without opening a web browser:
# Query secondary dead-drop via DNS UDP port 53:
dig +short TXT recovery.yourdomain.com | tr -d ' "\n'If configuring manually in your DNS provider (Cloudflare, AWS Route 53, Namecheap, Porkbun, etc.):
| Field | Value | Purpose & Operational Rationale |
|---|---|---|
| Type | TXT | Standard RFC 1035 text record; supported universally across all DNS providers. |
| Host / Name | recovery | Subdomain (e.g. recovery.yourdomain.com) matching your configured RECOVERY_DOMAIN. |
| TTL | 120 (2 min) | Low TTL guarantees rapid propagation across global recursive resolvers during vault rotation. |
| Value / Content | "<base64-ciphertext>" | Standard Base64 string produced by encrypt.js or the offline Web Builder. |
./scripts/deploy.sh or the offline web builder, the Cloudflare DNS API v4 automatically synchronizes the TXT dead-drop with 120s TTL and handles all RFC 1035 255-byte chunk splitting automatically.
Automate encryption, verification tests, and zero-persistence direct edge deployment in seconds.
# 1. Clone repository
git clone https://github.com/janhrabcak/identity-recovery.git
cd identity-recovery
# 2. Copy sample payload and populate credentials
cp templates/sample-payload.json payload.json
chmod 600 payload.json
vim payload.json
# 3. Direct Edge Upload to Cloudflare Pages (Zero Git Secrets)
./scripts/deploy.sh payload.json --provider cloudflare --project identity-recoveryEverything you need to know about the cryptographic primitives, threat model, and zero-dependency guarantees.
Universal, native zero-dependency browser compatibility. The standard W3C Web Cryptography API (window.crypto.subtle) natively implements PBKDF2 across 100% of modern browsers without requiring external WebAssembly (WASM) binaries or JavaScript polyfills. Argon2 is not part of native WebCrypto, which would require downloading an external 1–2MB WASM binary or third-party bundle.
By setting PBKDF2 to 600,000 rounds (exceeding OWASP's 2023 recommendation of 310,000 by nearly 2x), the terminal achieves rock-solid brute-force resistance while remaining a strictly self-contained single file that can execute completely air-gapped on any browser.
No. It is mathematically impossible. The vault is encrypted entirely on your local machine using AES-GCM-256 with a 96-bit CSPRNG initialization vector before any data is sent over the network. Hosting providers and DNS nameservers only store and serve opaque, authenticated ciphertext.
Key derivation and decryption execute strictly inside the volatile memory of your browser tab. Strict Content Security Policy (CSP) headers (default-src 'none') forbid outbound network requests during and after decryption.
True zero-knowledge cryptography has no backdoors. There are no server resets, emergency bypasses, SMS recovery, or administrative overrides. If your memorized passphrase is lost, the vault cannot be decrypted.
We recommend choosing a 6- to 8-word passphrase generated via high-entropy Diceware words and practicing memorization using spaced repetition before traveling.
If your primary web domain is unreachable or blocked by a local captive network, your recovery ciphertext is queryable as RFC 1035 TXT records from Anycast DNS servers worldwide. You can fetch your ciphertext using standard UDP port 53 (dig +short TXT recovery.yourdomain.com), via HTTPS over Cloudflare/Google DoH JSON resolvers, or by appending ?dns=recovery.yourdomain.com to any offline copy of the recovery HTML.
When operating on an untrusted or hotel business center computer, pressing Escape 3 times in rapid succession instantly triggers the emergency panic routine. This overwrites decrypted variables in memory, scrubs clipboard history with blank whitespace, and reloads the locked terminal state.
Additionally, an automatic 45-second clipboard scrub timer and visibilitychange / pagehide listeners ensure that sensitive tokens are purged even if you switch tabs or close the browser window.