How Key-Based Access Works

The Problem with Traditional Access

Most messaging apps use usernames, email addresses, or phone numbers to identify users and control access. This creates several problems:

• Your identity is exposed to the platform
• Accounts can be hacked or impersonated
• Friend requests and invitations create friction
• Your conversation history is tied to your identity

The LockNKey Approach

LockNKey takes a fundamentally different approach. Instead of identity-based access, we use key-based access. Here's how it works:

Creating a Vault

When you create a vault on LockNKey, you choose:

1. A lock name — a public identifier for the vault
2. A secret key — the password that protects access
3. A recovery question — in case you lose your key

The system generates a unique encryption key for your vault. This key is wrapped (encrypted) using your secret key and stored on our servers. The plaintext key never leaves your device.

Opening a Vault

To open a vault, you need:

1. The exact lock name
2. The correct secret key

The system uses your secret key to unwrap the vault's encryption key. If the key is correct, you gain access to all messages in that vault. If not, you see nothing.

No Accounts Required for Access

Here's the key insight: anyone with the lock name and secret key can access the vault. They don't need to create an account or be "invited." The key IS the invitation.

This means:

• You can share a vault with anyone, anywhere
• No sign-up friction for your contacts
• Complete anonymity — we don't know who's in your vault
• Easy collaboration without identity overhead

Security Considerations

Key-based access is secure because:

• The secret key is never transmitted to our servers
• We only store the wrapped (encrypted) version
• Brute-force attacks are impractical due to PBKDF2's 210,000 iterations
• Each vault has a unique encryption key

Best Practices

• Use strong, unique secret keys (at least 8 characters)
• Don't reuse keys across different vaults
• Share keys through secure channels (in person, encrypted email)
• Set up a recovery question in case you forget your key
• Consider using temporary vaults for sensitive conversations