Security

Last updated: August 2, 2026

Security is the product. This page summarizes how KyberCrypt protects your content. It is written to be accurate rather than aspirational.

Encryption

Every transfer is sealed with hybrid post-quantum cryptography: ML-KEM-768 (NIST FIPS 203) combined with X25519, so an attacker must break both a post-quantum and a classical algorithm. Bulk data is encrypted with AES-256-GCM. This mirrors the belt-and-suspenders approach used by modern TLS and Signal.

Key custody — stated honestly

• Password accounts — your private key is wrapped with a key derived from your password in your browser (Argon2id); the raw password never reaches our servers, and the stored verifier cannot be replayed as a credential. We cannot read your data at rest.
• Client-side file requests and the native/CLI apps — content is encrypted on your device; we receive only ciphertext we cannot read (zero-knowledge).
• Standard send/receive — to deliver features, the server transiently processes content in memory while sealing or unsealing it, then stores only ciphertext. It is never written to disk in readable form.
• SSO accounts — because they are passwordless, their keys are managed (escrowed) by the operator to enable identity-provider offboarding; these accounts are not self-custody. This trade-off is disclosed at configuration time.

Storage and deletion

At rest we store only ciphertext, with filenames sealed inside it. Files are deleted the moment the recipient downloads them (burn-after-download) or when their retention window expires. Deleted blobs are overwritten before unlinking; because they are already ciphertext, this is defense in depth on top of crypto-shredding.

Application security

• Two-factor authentication (TOTP) with recovery codes.
• Strict Content-Security-Policy, CSRF protection, and integrity verification of the in-browser cryptographic module before it runs.
• Request-link key pinning, so a compromised server cannot silently substitute recipient keys.
• A tamper-evident, hash-chained audit log.
• Breached-password screening at registration.

Reporting

Found a security issue? See our Vulnerability Disclosure Policy or email security@kybercrypt.com.