skills.rest
KeyArc
KeyArcOFFICIAL
Explore all skills by this author →
GitHub

keyarc-zero-knowledge

Implement client-side zero-knowledge encryption with WebCrypto and Argon2 key derivation.

Updated Aug 27, 2026
Search Tags:#encryption#client-side#zero-knowledge#Argon2#WebCrypto#authHash#vault-key
One-click install
npx skills add https://github.com/KeyArc/keyarc --skill keyarc-zero-knowledge
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: keyarc-zero-knowledge
Source: https://github.com/KeyArc/keyarc/tree/main/.claude/skills/keyarc-zero-knowledge
Command: npx skills add https://github.com/KeyArc/keyarc --skill keyarc-zero-knowledge

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides guidance for implementing a true zero-knowledge encryption layer in KeyArc, ensuring the server never sees plaintext secrets or passwords by performing all cryptographic operations in the browser.

Core Features & Use Cases

  • Client-side cryptography: all encryption and decryption occur in the browser using the WebCrypto API.
  • Argon2-based key derivation and authHash: master password handling and authentication happen entirely client-side.
  • Server data model: the server stores only ciphertext, auth hashes, and public metadata, never plaintext secrets.
  • Use cases: user signup/login, secret creation/updates, vault sharing, and cryptographic key management.
  • Example scenario: a user signs up, derives a master key in-browser, computes an authHash, and retrieves encrypted keys for local decryption.

Quick Start

Integrate the zero-knowledge flow by deriving the master key on the client, computing an authHash, authenticating to the server, and decrypting vault keys locally to access encrypted secrets.

Frequently Asked Questions about keyarc-zero-knowledge

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement client-side zero-knowledge encryption using WebCrypto?▼

To achieve zero-knowledge encryption, derive the master key in-browser using Argon2, compute an authHash for server authentication, then fetch and decrypt vault keys locally to access encrypted secrets.

How does Argon2-based key derivation work for client-side secret storage?▼

Argon2-based key derivation processes the master password locally in the browser to generate cryptographic keys. This ensures the server never handles the plaintext password, receiving only derived authentication hashes for validating user access.

Does zero-knowledge encryption support secure vault sharing workflows?▼

Yes, zero-knowledge encryption supports vault sharing workflows by utilizing client-side cryptography. Users can securely share encrypted secrets while ensuring the server only routes ciphertext and never exposes the underlying plaintext data.

Can I use WebCrypto for browser-based authentication without exposing plaintext passwords?▼

Yes, you can use WebCrypto for browser-based authentication by computing an authHash client-side. The server receives only this hash for verification, meaning plaintext passwords are never transmitted or stored on the server.

What are the limitations of a ciphertext-only server storage architecture?▼

A ciphertext-only server storage architecture limits the server's ability to perform server-side searches or computations on secrets. All data processing, decryption, and key management must be handled entirely within the user's browser.

Related Skills

Explore More Software Engineering Skills→
onichandameonichandame

client-side-encryption

Encrypt user data client-side with AES-256-GCM and PBKDF2 in SvelteKit.

Community
Advanced
stephnanguestephnangue
138

vault

Manage secrets, sign certificates, and encrypt keys via HashiCorp Vault API.

Community
Intermediate
b-open-iob-open-io
14

bitcoin-backup

Encrypt and decrypt private key backups using AES-256-GCM with PBKDF2.

Official
Advanced
cipherstashcipherstash
156

stash-encryption

Implement field-level encryption for TypeScript applications using @cipherstash/stack.

Official
Advanced