The only secure cold storage solution that protects your private keys and seed phrases from loss, fire and theft

The best way to protect your passwords, recovery phrases, or any secret information is cold storage. Cold storage maintains information offline. This establishes a physical barrier against someone trying to hack your information from a remote location. Xecrets take the concept of cold storage to the next level, protecting your assets against physical theft, loss, and disasters such as fires and floods.

You can store any string of text up to 5,000 characters in a set of Xecrets. This allows for the protection of passwords, private keys, and recovery phrases.

Yes, the Xecret.io app operates on the client-side (that is, user devices) offline, not on our servers. We do not store the confidential information of any client on our servers.

We randomize your private information down to each bit and store less than the threshold on each Xecret. Attackers can't learn anything from a single Xecret regardless of their computational resources. It is the physical. Please refer to our white paper for more details on how our technology works.

Increasing the threshold in a set improves security because it increases the difficulty of taking possession of the number of Xecrets necessary to recover the secret information.

The Xecret.io threshold system provides redundancy against loss, theft, damage, and destruction. If one Xecret is not accessible or readable, you can still decrypt your private information with the remaining Xecrets in the set.

If the threshold number of Xecrets were lost, the secret information would not be recoverable. For example, consider a set of three Xecrets with a threshold of two. If two of the three Xecrets were lost, then the confidential information would not be recoverable.

• Risk: An attacker may guess the contents of a single Xecret based on its length.
• Mitigation: Each Xecret has a maximum length based on the scannable codes involved. Rather than allowing Xecrets of different lengths, the Xecret.io system always pads to the full maximum length. Thus, the length of an individual Xecret will reveal nothing about the confidential information stored in it.
• Risk: A person may fail to store the secret slice securely or may lose it.
• Mitigation: The app could offer downloadable, standardized information sheets that users can share with their Xecret Keeper when negotiating the agreement to store the confidential information. The information sheet could include acceptable approaches for both preserving and hiding the secret.
• Risk: A threshold number of Xecret Keepers may collaborate and betray the user who created their Xecrets.
• Mitigation: When sharing with people, users should choose people who don’t know each other.
• Risk: Someone might create a public registry of the names of Xecret.io users, which might encourage unscrupulous Xecret Keepers to register the name of the user who entrusted them with their Xecrets, look for other Xecret Keepers in service to the same user, and collaborate to retrieve the confidential information.
• Mitigation: Ultimately, this system rests on the trustworthiness of the Xecret Keepers, be they individuals or corporate entities. Each Xecret.io user should choose their Xecret Keepers carefully. The extremely risk-averse, who must protect a critical item of confidential information, can use safe deposit boxes at different banks, taking humans almost entirely out of the equation.
• Risk: Photos taken on practically any device that connects to the Internet can propagate those photos automatically to iCloud Photos, Google Photos, or other cloud storage options. If a full set of Xecrets existed on one phone, the dispersal element of Xecret.io would collapse and allow a cloud administrator, or perhaps a hacker, to retrieve the confidential information.
• Mitigation: Literature included in Xecret.io instructs users to avoid adding photos of Xecrets to their camera roll or to immediately delete any such photos in their camera roll.
• Risk: Scanning a Xecret may trigger the analytics incorporated into Apple or Google phones to silently send that data to a data warehouse in the cloud, violating secrecy expectations.
• Mitigation: We are not sure whether this ever happens. But if it does, Xecret.io will offer a proprietary format for the physical Xecret, a format that consumer devices won’t automatically read.
• Risk: Web apps are less secure and trustworthy than those distributed through app stores. For example, even though the web app would be set up to do as much as possible client-side, and avoid sending secrets to the server, there are still risks.
• Mitigation: Xecret.io instructs users to cut off internet access while processing Xecrets for either dispersal or retrieval. It further enhances the security of users’ confidential information by instructing them to close all browsers and clear all browser history before re-enabling internet access. In many cases, this would protect a user from the consequences of a hacked and compromised application.