Keyper

A recovery phrase you keep in your head. On an offline Android phone or iPhone, Keyper turns your email and a sentence only you know into a standard BIP39 recovery phrase. The same inputs always give the same phrase, so you do not need to write it down. Keyper stores nothing you type.

Coming to Google Play and the App Store for US$29.99, paid once. Building it yourself from this repository is free and gives the same app.

getkeyper.app · English · 简体中文

• Standard output. BIP39 phrases of 12 or 24 words, usable with any wallet.
• Expensive to guess. Every guess costs an Argon2id run over 1 GiB of memory, 128 passes: about a minute on a Snapdragon 870. Above about 48.4 bits of entropy in the sentence, the attacker's electricity bill alone passes US$100 million.
• Its own keyboard. Both fields are typed only on Keyper's keyboard. The system keyboard never connects, so it cannot learn, sync or upload what you type.
• Offline gate. You can only type and generate with airplane mode on and Wi-Fi and Bluetooth off (iOS lets apps check only the network, so there Bluetooth is a reminder). Going back online wipes the sentence and the phrase at once.
• No permissions. Neither app asks for a permission or uses the network, and neither bundles a library beyond the system's own (and, on Android, the Kotlin standard library). The Android APK is about 95 KB, the iOS app well under 1 MB.
• Recovery drill. Re-type both inputs from memory and check on the spot that they give the same phrase.
• Open protocol. SPEC.md defines the derivation exactly (v1 is frozen), and an independent Python implementation reproduces it.

Android 8.1 (API 27) or later, or iOS 17 or later, with 4 GB of RAM or more. English and Chinese.

How it works

email ──── must be a valid address; lowercase A–Z ───────────────┐ salt
sentence ─ collapse extra spaces ─ HMAC-SHA256(domain) ─ Argon2id(1 GiB × 128) ─── K ─┬─ HMAC ─ 12 words
                                                                                      └─ HMAC ─ 24 words

• The sentence uses 80 characters: A–Z, a–z, 0–9 and 18 symbols ! @ # $ % ^ & * ( ) . , ? - _ + = /. Case, symbols and the spaces between words count; extra spaces (runs of spaces, spaces at either end) do not. There are no quotes, |, \, : or ;, which are easy to mistype or misread. Write other languages in Latin letters, for example Chinese in pinyin: Wo de di yi zhi mao jiao MiMi!
• The email must be a valid address, and every character counts except case: [email protected] and [email protected] are the same; [email protected] and [email protected] are not. Phone numbers are not accepted. The exact rule is in SPEC.md §2.
• 12 and 24 words are independent. Knowing one tells nothing about the other.
• The domain constant is 32 random bytes in Domain.kt and Domain.swift. It makes the same sentence give different phrases in different deployments. It ships inside the app, so it is public.

The email-as-salt construction is the standard one (WarpWallet uses it too): the same sentence gives unrelated phrases for different people, and an attacker has to attack one person at a time. One email can go with several sentences, each giving its own phrase.

The keyboard

letters                         digits and symbols
q w e r t y u i o p            1 2 3 4 5 6 7 8 9 0
 a s d f g h j k l             ! @ # $ % ^ & * ( )
⇧ z x c v b n m ⌫              . , ? - _ + = /  ⌫
123 [   space   ] Done          ABC [   space   ] Done

• Identical on every phone: fixed QWERTY, fixed sizes that ignore the system font scale, and a monospace face that tells 0/O and 1/l/I apart. The email gets @ and . on the bottom row and a Next key.
• Touch works as on the iPhone. Every point belongs to its nearest key, so taps between keys still type. The key under your finger pops up magnified and types when you lift, so you can slide to the right key first. A second finger landing types the first one's key at once, so fast two-thumb typing keeps its order. ⇧, ⌫ and 123 act on touch-down.
• ⇧ once for one capital, twice for caps lock; hold ⌫ to keep deleting; Back closes the keyboard. Edge swipes over the keyboard are not taken as Back.
• The cursor is the system's own: tap to place it, drag it (or its handle) to move it, with the magnifier.
• The fields give the system keyboard no connection at all. Paste, the long-press menu, drag-and-drop, hardware keys and injected key events are all blocked.

Security model

The code and the domain constant are public: assume every attacker has them.

An attacker has…	What still protects the phrase
your email	how hard your sentence is to guess: every guess costs 1 GiB × 128 passes
your sentence	only your email, which is usually not a secret
your email and your sentence	nothing: together they are the phrase

1. Length does not make a sentence hard to guess. Famous lines, lyrics, proverbs and templates like "my cat is called X" are an attacker's first guesses and fall for a few dollars of electricity. Use details only you know: names, years, places, numbers, a symbol or two.

   Entropy of the sentence	1000 top GPUs	Electricity alone
   30 bits	7.5 hours	US$300
   40 bits	320 days	US$305,000
   50 bits	890 years	US$313 million
   60 bits	910,000 years	US$320 billion

This is the beginning of the README. Read the rest at the original. Read the full README ↗