LockRoot Quick Start

Getting started with LockRoot requires an understanding of its strict, local-first security model. There are no cloud servers to sync with, and no recovery emails.

1. Create Your Local Vault

Upon launching the application for the first time, you will be prompted to create a new local vault.

You must select a Master Password. LockRoot enforces a strict minimum of 12 characters.

• Warning: Because LockRoot prioritizes absolute local data sovereignty, there are no password reset flows or remote recovery options. If the master password is forgotten, the vault is permanently inaccessible.

2. Cryptographic Initialization

When you confirm your master password, the application generates a random 32-byte salt and derives a 256-bit key using the Argon2id Key Derivation Function (KDF). This process targets an execution time of 500ms–1000ms using 64 MiB of memory, 3 iterations, and 2 parallel lanes to defend against offline brute-forcing.

3. Adding Entries

Once inside the vault, you can begin adding your credentials. The payload is encrypted exclusively using AES-256-GCM.

• Memory Security: When you authenticate or view a password, LockRoot explicitly zeroes the memory buffers holding your master password to prevent extraction via memory forensics.

4. Backups and Exporting

Because LockRoot uses zero cloud synchronization, you are entirely responsible for your backups. You can export your vault (Lockroot_EXPORT) to a secure location (such as an encrypted USB drive). Exports are encrypted with a separate password and a unique salt to prevent accidental imports of live vault files.