Encryption at Personarium: the local vault, and why we think quantum-safe

Encryption isn't a bullet point on a feature list for us — it's a concrete second data space on your device. And because encryption is a promise that has to hold for years, we built it from the start to survive a quantum computer, not just today's threats.

The vault is a second data space, not a switch

Your regular Personarium database sits unencrypted on disk — deliberately, since it never leaves your device anyway, and full-disk encryption is your operating system's job (BitLocker, FileVault). The vault is something else: a second, password-locked database that you deliberately move individual characters and their chats into. Unlocked, you work in it normally; locked, its contents aren't readable without your password — not even by us, since we never see it.

What's actually inside

Your password is never used as the key directly. It runs through Argon2id, a key derivation function with OWASP-baseline parameters that deliberately costs time and memory — making guessing attempts expensive. That produces a 256-bit key for the vault database itself (SQLCipher, AES-256), plus a second, random key that encrypts every media file in the vault individually (XChaCha20-Poly1305). Both are purely symmetric — that's not a simplification here, it's the deliberate choice everything in the next section builds on.

Honestly: there's no password reset

There's deliberately no escrow, no recovery, no support path that can open your vault. Forget your password, and the contents stay encrypted — permanently. That's not an oversight, it's the flip side of real protection: an emergency backdoor is always a backdoor for every other case too. For the same reason, the automatic backup run skips the vault by default — otherwise an unlocked vault could quietly end up unencrypted inside a cloud-synced backup folder.

What's already quantum-safe — and what's still ahead

The threat is called "harvest now, decrypt later": ciphertext captured today could be decrypted later with a quantum computer. Pure 256-bit symmetric crypto like the vault's isn't affected — the relevant quantum algorithm (Grover's) only halves the effective key length, leaving 128 bits of security still out of reach. Signatures are a different story: license tickets and the auto-updater are signed today with classical Ed25519. That's deliberately built so a future post-quantum signature scheme can be added later as a pure data update, without breaking the format — but the actual algorithm switch waits until those schemes are mature. Moving to unproven cryptography early would be a risk of its own.

256-bit encryption is already quantum-safe today — what we're preparing is the signature, not the key.