Your Echo ID is protected by a non-extractable key, a passphrase-sealed vault, and hardware-backed passkey unlock. That is the strong part. Here is the part most projects hide: we do not claim it is unhackable. Below is exactly what each layer defends — and what no browser credential can defend. Superior security plus a stated limit is the only kind worth trusting.
Your Echo ID signing key is a non-extractable ECDSA P-256 keypair held in IndexedDB. The private key is never a value any script can read — not a malicious extension, not injected code, not us. It can sign, but it can never be copied off your device.
The owner secret is encrypted with AES-256-GCM under a key derived from your passphrase via PBKDF2 at 310,000 iterations. Your browser storage holds only ciphertext. The passphrase itself is never stored and never sent anywhere.
Ownership is proven by signing a fresh random challenge, not by exposing the secret. You can demonstrate the identity is yours as many times as you like, and the secret never leaves the vault to do it.
Add a platform passkey (Touch ID, Face ID, Windows Hello) and your secret unseals from a key that only your authenticator hardware can reproduce — and only after a biometric or PIN gesture. There is no passphrase to type, so there is nothing to keylog.
Two ways to lock an Echo ID, each with its own honest ledger. A green column is what the layer genuinely stops. A red column is what it cannot — stated plainly, because a security page that only lists wins is marketing.
There is no recovery path we control. We cannot read your secret, cannot reset it, and cannot hand it to anyone who asks — including a court, an attacker, or ourselves. If you lose every unlock you set up, the secret is gone.
That is not a missing feature. It is the guarantee: a system that cannot be compelled to betray you is stronger than one that promises it never will.
Whatever intelligence you use, the key to your identity stays on your device, in your hands. We built the walls high — and we told you where the doors are.