BlindLock is a new local-only password manager, notes app, and secure vault that conceals your sensitive data inside an ordinary-looking .PNG image file. The application requires no cloud storage and no central vault account, and it can optionally bind to your hardware using TPM 2.0, Secure Enclave, or StrongBox. Its solo developer, David Domingo, is currently selling lifetime licenses starting at EUR 42.
Prospective users can try an interactive online demo, which uploads and downloads nothing, as well as a full downloadable 7-day trial.
Domingo says one of the main reasons he built the app was the theft of customer vault backups from LastPass in late 2022. He argues that the same incident could have affected 1Password, Dashlane, or even Proton Pass. “When your vault sits on someone else’s server, you inherit every risk that server carries: employee access, infrastructure vulnerabilities, government subpoenas, supply chain attacks, and the simple mathematical reality that a server holding tens of millions of vaults is a far more attractive target than your laptop,” he wrote on his blog.
Three Independent Layers of Security
BlindLock applies three independent layers of security to protect your vault. First, the vault is invisible inside its ordinary-looking PNG carrier rather than simply encrypted. Second, because BlindLock runs no central vault database, there is nothing for attackers to steal from company servers and crack later. Third, the resting vault file uses 256-bit authenticated encryption and already includes NIST post-quantum components, and it is bound to your device.
“The vault opens only when three things match: the carrier file, your master password and your authorized device,” the app page states. “A copied file alone is not enough to gain access.” The vault key is sealed to the device’s security chip, whether that is TPM 2.0, Secure Enclave, or StrongBox, depending on the platform.
Features, Hidden Volumes, and Pricing
The feature set is broad for a new product. Encrypted inside your chosen .PNG image is a password manager, Markdown-supported secure notes, a built-in 2FA authenticator, and an encrypted file vault for any file type. There is also support for an optional fourth-factor security key such as a YubiKey or Google Titan.
To keep the main .PNG file from becoming bloated, users can store larger files separately in their own encrypted containers. BlindLock uses a hidden volumes system similar to VeraCrypt for these containers. Domingo acknowledges they are “not magically unfindable,” but notes they are Argon2id-hardened, protected with 256-bit authenticated encryption, and stored inconspicuously. For device loss or migration, users must create an encrypted BlindLock backup and store its recovery phrase separately.
BlindLock is launching as a one-time EUR 42 purchase, but this perpetual pricing applies only to the first 1,000 licenses across three waves: the first 100 at EUR 42, the next 350 at EUR 77, and the final 550 at EUR 94. After that, BlindLock will be available on a subscription-only basis.
Source
Image: tomshardware.com
