Starkive StudioStarkive Vault
A vault that cannot be read, including by us.
- Argon2id
- AES-256-GCM per record
- Windows Hello · Touch ID
One master password you choose, never stored and never sent. Every record is sealed on your own machine, so there is no account to breach and nothing in a cloud to leak.
Starkive Vault is part of the $1.99 unlock.
What it does.
- 01
One master password
Everything is sealed under a single password you choose. It is never stored or sent anywhere.
- 02
Argon2id key derivation
Your password runs through Argon2id, a memory-hard function, to derive the key. That makes brute-force cracking expensive rather than merely slow.
- 03
AES-256 per record
Every entry, its title included, is sealed with AES-256-GCM. A stolen vault file reveals nothing without your password.
- 04
Windows Hello, or Touch ID
Optionally unlock with your face, fingerprint or PIN on that device — Windows Hello on a PC, Touch ID on a Mac. The master password stays the root of trust.
- 05
Logins, keys, notes, phrases
Store website logins, API keys, secure notes and recovery phrases, each with the fields that fit.
- 06
It lives on your device
The vault file stays on your machine. There is no account to breach and nothing to leak in the cloud.
A password nobody stores is a password nobody can reset
The master password is never sent to us and never written down by the app, which is the property the whole design rests on. It also means that if you lose it, we cannot help you recover the vault. Keep it somewhere you will still have it in five years.
The others come with it.
One app, one $1.99 unlock. These are not add-ons and there is no upgrade path between them — you either have Studio or you do not.
Starkive Archive
Lock a file or folder with strong encryption — a password ZIP, a 7-Zip archive, age, or OpenPGP. It reads 13 archive formats too, so it is the only unzip tool you need as well.
Starkive PDF
A PDF is a program format, and opening one is where most of the risk in a document workflow actually sits. Starkive decodes every file in a separate process that cannot reach the network, read your files or start anything. Above that line it behaves like the desktop editor you already know.
Redaction
Mark the words you want removed and Starkive deletes the content underneath rather than painting a rectangle over it. It runs on your machine, in the same sandbox as everything else, and writes a new file so your original is never touched.
Authenticator
Keep your two-factor secrets next to the passwords they protect. Codes are generated on your device to the TOTP standard, sealed by the same Argon2id and AES-256 vault, and unlocked with Windows Hello or Touch ID.
Trust Split
Break a passphrase, recovery phrase or exported key into shares using Shamir's Secret Sharing. You choose how many shares exist and how many are needed to rebuild it; anything fewer reveals nothing at all. It runs entirely on your machine.
Back to Starkive Studio, or see both products.