Complete technical guide to ZK Password Vault with Light Protocol ZK Compression, military-grade AES-256-GCM encryption, and decentralized IPFS storage.
ZK Password Vault is a next-generation password manager built on Solana blockchain using Light Protocol ZK Compression. Your passwords are encrypted client-side, stored on decentralized IPFS, and verified on-chain with zero-knowledge proofs.
AES-256-GCM with PBKDF2 key derivation (600,000 iterations)
Light Protocol ZK Compression reduces on-chain costs dramatically
Encrypted data on IPFS via Pinata, only CID reference on-chain
Only you can decrypt - wallet signature derives encryption key
┌─────────────────────────────────────────────────────────────────────────┐ │ ZK PASSWORD VAULT ARCHITECTURE │ ├─────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ CLIENT │ │ BACKEND │ │ SOLANA │ │ │ │ (Browser) │ │ (Next.js) │ │ (Devnet) │ │ │ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ │ │ │ │ │ │ │ ┌────▼────┐ ┌────▼────┐ ┌────▼────┐ │ │ │ AES-256 │ │ Light │ │ ZK Comp │ │ │ │ Encrypt │ │ Protocol│ │ Account │ │ │ └────┬────┘ │ SDK │ └─────────┘ │ │ │ └────┬────┘ │ │ ┌────▼────┐ │ │ │ │ IPFS │◄──────────────┘ │ │ │ Upload │ (Helius RPC) │ │ └────┬────┘ │ │ │ │ │ ┌────▼────┐ │ │ │ Pinata │ │ │ │ Gateway │ │ │ └─────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────┘
// Key Derivation
signature = wallet.signMessage("ZK-Vault-Encryption-Key-v1")
key = PBKDF2(signature, salt, 300000, "SHA-256") // Vault key
passwordKey = PBKDF2(signature, salt2, 300000, "SHA-256") // Per-password
// Triple Encryption (600,000 total iterations)
nonce = crypto.getRandomValues(12 bytes)
ciphertext = AES-256-GCM.encrypt(passwords_json, key, nonce)
output = base64(nonce || ciphertext || auth_tag)🔐 Security Note: AES-256-GCM is the same encryption used by banks, governments, and military. With 2^256 possible keys, brute-force attacks are computationally impossible - it would take billions of years with all computers on Earth.
Light Protocol uses zero-knowledge proofs (Groth16/Poseidon) to compress on-chain state, reducing storage costs by 99.1% while maintaining full verifiability.
⚡ ZK Compression: Data is stored in compressed Merkle trees with Poseidon hashes. Validity proofs (Groth16) ensure only legitimate updates are accepted.
Helius provides enterprise-grade Solana RPC with native ZK Compression support. Their infrastructure handles the complex cryptographic operations required for Light Protocol transactions.
Native support for getStateTreeInfos(), getValidityProof(), and compressed account operations.
99.9% uptime SLA with global edge network for low-latency transactions.
Pinata provides reliable IPFS pinning for encrypted vault data. Content-addressing ensures data integrity - if the CID matches, the data is authentic.
🔒 Privacy: Only encrypted ciphertext is stored on IPFS. Without your wallet's encryption key, the data is meaningless random bytes.
AES-256-GCM encryption happens in your browser. Passwords never leave your device unencrypted.
Encryption key is derived from your wallet signature. Only you can decrypt.
Encrypted data stored on IPFS, not blockchain. Only CID reference is on-chain.
Light Protocol ZK proofs verify ownership without revealing any data.
| Attack Vector | Protected? | How? |
|---|---|---|
| Brute-force encryption | ✓ | AES-256 = 2^256 combinations |
| Server breach | ✓ | Backend never sees encryption keys |
| IPFS data leak | ✓ | Data is encrypted, unusable without key |
| Man-in-the-middle | ✓ | HTTPS + client-side encryption |
| Wallet key theft | ⚠ | Use hardware wallet for maximum security |
Click "Connect Wallet" and approve with Phantom, Solflare, or any Solana wallet.
One-time signature to derive your unique encryption key. This happens locally.
Add your credentials. Use the password generator for strong passwords.
Click save, approve the transaction (~$0.001), and your vault is secured on-chain!