Post-Quantum Password Security
PassQ wraps every secret in cryptography built for the era after quantum computers arrive. A strong passphrase isn't just hard to crack — by every credible measure, it cannot be cracked before the star powering the attacker burns out.
01 — Classical brute force
Suppose an attacker steals your encrypted vault and every public value with it. To open it they must guess a 12-character passphrase, and each guess has to survive Argon2id — a memory-hard function that turns 256 MiB of work into a single attempt. Even a planetary-scale cluster manages only about a million guesses per second.
Figures assume 12 characters drawn uniformly from the 95 printable ASCII symbols (≈78.8 bits) and an attacker who has already obtained the wrapped vault. In practice PassQ also mixes in a device secret, so the passphrase alone is never sufficient — this scenario is the best case for the attacker.
02 — Quantum brute force
Shor's algorithm shatters RSA and elliptic curves. PassQ uses neither. Its public-key layer is built on NIST's post-quantum standards, so a quantum computer gains nothing there. The only quantum lever left is Grover's algorithm against the passphrase — and it only square-roots the exponent.
Grover's only trick is amplitude amplification: an oracle flips the correct answer's phase, then a diffusion step reflects every amplitude about the mean — ratcheting the right answer up a sliver each round. Because each round gains only ~1/√N, you need √N ≈ 10¹¹ rounds, and every one must run the full Argon2id computation coherently. On optimistic fault-tolerant hardware that still lands near 23 million years — and Grover can't be parallelized to escape it.
03 — Creating an item
Saving a password never exposes plaintext to the server. Your device unlocks the vault key, mints a fresh per-entry key, seals the secret, and signs the result — all locally, in the time it takes to glance at your phone.
Face ID releases the device secret; combined with your passphrase it derives the wrapping key.
The wrapping key decrypts the master keypair into memory. The server never sees it.
A random 32-byte DEK is generated for this entry alone — never reused across items.
The secret is padded and sealed under the DEK with authenticated encryption.
The finished blob is signed so any reader can verify authorship before trusting it.
Local-first · zero-knowledge · post-quantum
Everything is encrypted before it leaves your device. The server holds nothing but ciphertext, public keys, and metadata — and even a quantum adversary runs out of time long before it runs out of universe.