BlindLock hides your password manager and secure vault in a PNG image - also offers secure notes, 2FA, and a crypto address book, with optional hardware security keys

BlindLock, a new security application from solo developer David Domingo, launches as a one-time purchase aimed at US users who want to keep their passwords and sensitive files off remote servers. The tool hides an encrypted password manager, secure notes, a two-factor authenticator, and a file vault inside an ordinary-looking PNG image. Domingo said the theft of customer vault backups from LastPass in late 2022 was a key motivation, arguing that any cloud-based vault service, including 1Password, Dashlane, and Proton Pass, carries risks from employee access, infrastructure flaws, government subpoenas, and supply chain attacks. He added that a server holding millions of vaults is a more attractive target than a personal laptop.

BlindLock uses three independent layers of security. The vault is not just encrypted but also invisible within its PNG carrier, and there is no central database on BlindLock servers for attackers to steal. The resting vault file uses 256-bit authenticated encryption and includes NIST post-quantum components. Access requires three simultaneous factors: the carrier file, the user’s master password, and an authorized device, with the vault key sealed to that device’s security chip, such as TPM 2.0, Secure Enclave, or StrongBox depending on the platform. A copied file alone is not enough to open the vault.

The feature set is broad for a new offering. Inside the encrypted PNG, users get a password manager, Markdown-supporting secure notes, a built-in 2FA authenticator, and an encrypted file vault for any file type. There is also support for an optional fourth-factor hardware security key like a YubiKey or Google Titan. To avoid bloating the central PNG file, larger files can be stored separately in their own encrypted containers, using a hidden volumes system similar to VeraCrypt. Domingo acknowledged these containers are not magically unfindable, but said they are hardened with Argon2id and 256-bit authenticated encryption.

For device loss or migration, users must create an encrypted BlindLock backup and keep its recovery phrase separate. The pricing model is structured as a one-time purchase of $49 for the first 100 licenses, then $89 for the next 350, and $109 for the final 550. After those 1,000 licenses, the app becomes subscription-only. Domingo said this perpetual pricing for early adopters is meant to build a solid financial foundation so development can continue.

The announcement does not include a recommendation, and the developer has made online and downloadable demos available for users to judge the product themselves. BlindLock is aimed at US consumers concerned about the centralized nature of mainstream password managers and who want a vault that exists only on their own devices. The lack of a server-side database means there is nothing for attackers to target on BlindLock’s infrastructure, though the reliance on a carrier file and device binding means users must manage backups carefully.

More software news from TechManNews.