Why Secret Keys Are More Secure Than Passwords

The Password Problem

Passwords have been the standard for digital security for decades, but they have fundamental weaknesses:

• Reuse: People reuse passwords across multiple sites
• Weak choices: Common passwords like "123456" remain popular
• Phishing: Passwords can be stolen through fake login pages
• Server storage: Password databases are valuable targets for hackers

When you create an account on a traditional platform, your password is stored (usually hashed) on their server. If that server is breached, your password could be compromised.

How Secret Keys Are Different

In LockNKey's key-based system, the secret key works differently:

No Server-Side Key Storage

When you create a vault, your secret key is used to derive an encryption key via PBKDF2 (210,000 iterations). This derived key is then used to wrap (encrypt) the vault's actual message key. Only the wrapped version is stored on the server.

Your plaintext secret key never touches our servers.

Derived, Not Stored

The key derivation process means:

1. Your secret key → PBKDF2 (210k iterations) → derived key
2. Derived key → AES-256-GCM → wrapped message key
3. Only the wrapped key is stored

Even if our database is compromised, attackers would need to brute-force each key with 210,000 PBKDF2 iterations — making attacks computationally impractical.

No Identity Tied to Keys

Traditional passwords protect accounts. Key-based access protects content. The difference:

• Passwords: "Who are you?" → Grant access to everything associated with that account
• Keys: "Do you have the right key?" → Grant access to one specific vault

This means compromising a key only affects one vault, not your entire digital identity.

The Math Behind the Security

PBKDF2 with 210,000 iterations means an attacker must perform 210,000 hashing operations for each guess. On modern hardware, this makes brute-force attacks extremely slow:

• A fast GPU might attempt 100,000 PBKDF2 hashes per second
• An 8-character key with mixed case, numbers, and symbols has trillions of combinations
• Even with massive computing power, cracking a strong key would take years

Best Practices for Secret Keys

To maximize the security of your vault keys:

1. Use at least 12 characters — longer is better
2. Mix character types — letters, numbers, symbols
3. Avoid dictionary words — they're easier to brute-force
4. Don't reuse keys — each vault should have its own
5. Share securely — never send keys via unencrypted channels

The Future of Access Control

Key-based security represents a shift from "who you are" to "what you know." This model:

• Reduces identity theft risk
• Enables anonymous collaboration
• Puts users in control of their access
• Aligns with privacy-first principles

LockNKey is built on this foundation — giving you secure, private conversations without the vulnerabilities of traditional password systems.