01 / 03
Rust cryptography core
The small, network-free library responsible for key derivation, key separation, authenticated encryption, and sensitive-memory cleanup.
Browse buddy-crypto-core ↗Open where trust matters
Don't trust a promise.
Inspect the machinery.
Buddy is commercial desktop software. Its cryptography, vault format, and recovery path are public, so the claims can be tested and your data never depends on our survival.
An important boundary
The desktop UI, updater, and licensing code are not open source. Buddy has not yet completed an independent security audit. Open code improves inspectability; it is not a magic certificate of safety.
02 / 03
Vault format specification
A versioned description of the SQLite schema, encrypted envelopes, KDF parameters, subkey contexts, attachment layout, and compatibility guarantees.
Read the specification ↗
03 / 03
Break-glass recovery tool
A standalone Rust CLI for inspecting, decrypting, and exporting a Buddy vault without installing the desktop app or contacting Buddy.
Get buddy-rescue ↗Reproducible exit
Your emergency door does not use our servers.
The break-glass tool is intentionally boring. Give it a vault, enter the master password locally, and export a documented JSON or CSV file. It shares the public crypto core, but none of Buddy's licensing or network code.
How to test your exit path# Inspect the file. No password, nothing decrypted.
$ buddy-rescue inspect buddy.sqlite
Format: buddy-vault-v1
SQLite integrity: ok
Schema migration: 1
Vaults: 1
Personal
Vault version: 1
Entries: 214 live, 0 trashed
Attachments: 12 records, 12 present, 0 missing
KDF: argon2id · 65536 KiB · t=3 · p=4 · version 19
Status: compatible
# Decrypt locally and write the export.
$ buddy-rescue export buddy.sqlite --format json
Master password: ••••••••••••
Recovered 214 entries and 12 attachments to buddy-export
Published parameters, not “military-grade” adjectives
The current vault profile
- KDF
- Argon2id
- 64 MiB · t=3 · p=4
- Encryption
- XChaCha20-Poly1305
- 256-bit key · 192-bit nonce
- Key separation
- HKDF-SHA-256
- Independent entry, blob & verifier contexts
- Memory handling
- zeroize
- Plaintext serialization buffers wiped on drop
Read the code. Then try the product.
Every feature is available for 30 days without an account or credit card.
Download Buddy