- .01
We hold none of your data.
Kvant has no backend that processes file content. Every encryption and decryption runs in your browser or in your own agent runtime, and no server of ours receives your files, their names or your keys. We hold no plaintext and no keys, so under legal compulsion there is nothing to hand over. Like any web app, the browser side is only as safe as the code served from kvant.world.
- .02
NIST-standardized algorithms only.
Kvant uses ML-KEM-768 and ML-DSA-65, the algorithms standardized by the U.S. National Institute of Standards and Technology as FIPS 203 and FIPS 204 in 2024. We do not invent cryptography. We integrate the standards through open-source libraries.
- .03
Resistant to quantum computers.
Classical encryption, the kind securing most of the internet today, can be broken by a sufficiently powerful quantum computer. Kvant uses a hybrid approach: an attacker must break both a post-quantum algorithm and a classical one simultaneously. Breaking one is not enough.
- .04
Your keys stay yours.
Kvant does not store, escrow, or have access to your encryption keys. Keys are derived from your wallet or a key file you control entirely. If you lose access to your keys, there is no recovery mechanism, and that is intentional. Wallet users can save a passphrase-wrapped key file backup of the same keys from the app.
- .05
Tampering is detected.
Every .kvant file carries a cryptographic signature. If any byte is modified after encryption, whether by accident or intent, decryption fails with an explicit error. A file that decrypts is a file that has not been touched.
Open-source foundations
The post-quantum and classical primitives come from @noble/post-quantum and @noble/curves: the noble suite, a widely used open-source standard for cryptography in JavaScript. @noble/curves and @noble/hashes have been independently audited (Argon2id was outside that audit's scope); @noble/post-quantum has not been yet. Kvant itself has had no third-party audit. Key wrapping uses Argon2id; symmetric encryption uses the browser-native WebCrypto AES-256-GCM. We integrate these libraries; we do not roll our own.
Reporting a vulnerability
Write to hello@kvant.world with the steps to reproduce. Please give us a chance to fix the issue before you disclose it publicly.