Zero-Trust Technical Capabilities

Cryptographic Engineering Built for Total Ownership

Explore how AMPCrypt secures data at rest, in transit, and during recovery using Web Cryptography Standards and client-side hardware isolation.

Open Web Vault Read Whitepaper

Core Cryptographic Components

Select a subsystem to inspect implementation specifics

Symmetric Cryptography Standard

Authenticated Galois/Counter Mode Encryption

Every payload uploaded or processed by AMPCrypt is encrypted client-side using 256-bit AES in GCM mode. This provides both confidentiality and built-in message authentication codes (MAC), protecting against ciphertext tampering.

Key Derivation: PBKDF2 with 600,000 SHA-256 iterations & Scrypt salt fallback.
Unique Nonce Generation: 96-bit cryptographically secure random initialization vector per file.
Zero Data Residue: Keys reside exclusively in RAM memory during execution.

// WebCrypto Subsystem Initialization

const key = await crypto.subtle.deriveKey(
  {
    name: "PBKDF2",
    salt: crypto.getRandomValues(new Uint8Array(32)),
    iterations: 600000,
    hash: "SHA-256",
  },
  passphraseKey,
  { name: "AES-GCM", length: 256 },
  false,
  ["encrypt", "decrypt"]
);

Architecture Comparison

How AMPCrypt compares to conventional cloud storage providers

Security Feature	AMPCrypt	Standard Cloud Storage	Traditional PGP
Zero-Knowledge Key Storage	✓ Client Hardware Only	✗ Provider holds keys	✓ Local Keyring
Multi-Share Key Splitting (SSS)	✓ Built-in Galois Fields	✗ Not Supported	✗ Requires manual setup
Browser Zero-Knowledge Vault	✓ WebCrypto Native	✗ Server-side decrypt	✗ Extension required
Encrypted Multi-Backend Sync	✓ WebDAV, Cloud & Local	✗ Vendor Lock-in	✓ Manual transfers