Security is not a feature. It's the foundation.

Any server storing encrypted vaults is a target. By eliminating servers entirely, we eliminate the entire attack surface.

The BIP-39 seed phrase is the only master key to your vault. The app and RESCATE_OFFLINE.html both derive the encryption key from those 12 words — Android uses a memory-hard KDF (Argon2id), while iOS and the Recovery Kit use PBKDF2-SHA512. Either way, this guarantees that the Recovery Kit works without needing to remember any additional password — only the words you already have on paper.

RESCATE_OFFLINE.html is deliberately built as a single self-contained HTML file with zero external dependencies or bundled libraries — that's what lets anyone audit it by opening it in a plain text editor, with no third-party supply chain to trust in 2040. Bundling an Argon2id library, native or via JavaScript, would break that zero-dependency principle. That's why both iOS and the Recovery Kit use PBKDF2-SHA512 with 600,000 iterations, keeping the two consistent. Android has no such constraint, so it uses Argon2id — the stronger KDF — instead. Either way, the real defense against brute-force isn't the specific KDF: it's the 128 bits of entropy in your seed phrase, which both derive their strength from.

Verification does happen — just not by storing anything. Your twelve words carry 128 bits of entropy plus a 4-bit checksum derived from them — 132 bits in total, which is exactly what the twelve words encode. That checksum catches a mistyped word before any decryption is even attempted. If the seed is wrong in a way the checksum misses, the derived key is wrong too. When unlocking or importing, the AES-256-GCM authentication tag fails, telling you the seed is incorrect. When exporting, the derived key is compared directly against the vault's actual master key instead — same outcome, different mechanism, because no decryption happens at that step.

Selvum marks all copied content as sensitive so it is hidden from clipboard history and cannot be read by other apps.

Existing formats like KDBX are mature and battle-tested, but they're built for feature-rich, extensible password managers with plugin ecosystems. The Recovery Kit's core requirement was different: it has to be small enough to read and audit in full, in plain JavaScript, with zero dependencies. A minimal custom format kept that goal achievable. The tradeoff is explicit: less interoperability with other tools, in exchange for a recovery path simple enough that anyone can verify exactly what it does before trusting it.

BIP-39 mandates NFKD for its own seed derivation — the step that turns a mnemonic into a binary seed via PBKDF2 with a fixed salt. Selvum doesn't use that step: the twelve words go straight into the key derivation function as the passphrase, so the choice of normal form is ours to make. NFC is what phone keyboards emit, and it's how the BIP-39 wordlists shipped with the app are stored — the form users actually produce when they type their phrase.