Back to browse
I built a paper-based vault with m-of-n keys

I built a paper-based vault with m-of-n keys

by boazeb·Mar 22, 2026·4 points·0 comments

AI Analysis

●●●BangerBig BrainNiche Gem

Shamir's Secret Sharing on paper solves digital inheritance without trusting a cloud service.

Strengths
  • m-of-n threshold keys distributed on paper enable social recovery without single points of failure.
  • Runs entirely offline in browser ensuring secrets never leave your machine.
  • QR codes with error correction survive physical damage better than handwritten seed phrases.
Weaknesses
  • Physical paper still vulnerable to fire or flood despite error correction.
  • Requires trusting the JavaScript code running in the browser at creation time.
Category
Target Audience

Security-conscious individuals, crypto holders

Similar To

SeedQR · Unchained Capital · Cryptosteel

Post Description

What happens to your passwords and seed phrases if you get hit by a bus? That's the problem I built PaperVault to solve.

I built PaperVault because I needed a way to store secrets (like 2FA recovery codes, hard disk encryption keys, and seed phrases) without depending on any device, cloud service or company surviving.

I needed something my family could access in an emergency without exposing them directly to the passwords or burdening them with having to secure everything correctly over the course of many years.

PaperVault encrypts your data with AES-256-GCM, with the decryption key split into shares using Shamir's Secret Sharing. You pick how many keys to create and how many are needed to unlock, e.g 3-out-of-5. The vault and keys are printed as QR codes on paper.

Everything runs in the browser with no server involved. It's designed to work offline on an air-gapped machine.

Source: https://github.com/boazeb/papervault

Live Demo: https://papervault.xyz

Happy to answer questions about the implementation or the design choices.

Similar Projects

Security●●Solid

Aquaman keeping your OpenClaw secrets safe

The plugin-proxy split is smart: credentials live in a backend (Keychain/1Password/Vault/etc.) and a separate proxy injects auth headers over a UDS so the agent process never handles raw keys. It autosurveys plugin configs and channels to migrate plaintext secrets and even ships a Docker image and CLI for local setups — very practical for anyone already on OpenClaw, though it’s narrowly focused and adds an extra trusted component that deserves an audit.

Niche GemSolve My Problem
tech4242
103mo ago