Table of contents

  1. Destroy the dongle. Your files are on Google Drive. Nobody can open them.
  2. The procedure
  3. What you have now
  4. Why
  5. Four years later
  6. Why this is possible at all
  7. One more thing, said carefully

Destroy the dongle. Your files are on Google Drive. Nobody can open them.

8/1/2026 / 3 minutes to read / Tags: hardware, architettura, self-hosted

There is a use case for Crypt-in we did not design for, and that works perfectly.

We call it extreme cold storage.

The procedure

Buy a Crypt-in dongle — or build one with a €5 ESP32-S3. Write your 24-word seed and your 6-digit PIN on paper. Encrypt your files. Make copies, as many as you want, on as many drives and cloud services as you want. Verify that everything opens. Then physically destroy the dongle.

What you have now

Your files are everywhere: Google Drive, Dropbox, OneDrive, USB sticks, email attachments. Visible to anyone who knows where to look.

Nobody can open them. Not Google. Not your government. Not lake8.dev. Not you — until you restore the seed.

Why

The file keys derive from your 24 words through a deterministic function, HKDF-SHA256. Those words never left that piece of paper. The dongle was a vessel: needed for ten minutes to generate the key, then discarded.

The encrypted files are useless without the words, in the specific sense that breaking AES-256-GCM without the key requires computational resources that do not exist and are not projected to.

Four years later

Buy a new ESP32-S3 for €5, anywhere, from any supplier. Flash the firmware. Type your 24 words. The PIN comes back on its own — it is derived from the seed, not stored anywhere. Your files open.

The dongle lived for ten minutes. The encryption lasted forever.

Why this is possible at all

Vendor-blind architecture. lake8.dev cannot decrypt those files — not by policy, not by choice, but because we never held the key material.

Upload the encrypted files to Google Drive and Google has the ciphertext. We have nothing. A government can subpoena Google. It cannot subpoena arithmetic.

The only things that matter are your 24 words on a piece of paper and a €5 chip you can buy anywhere, any time.

One more thing, said carefully

Nobody memorises 24 random words. You cannot be made to recite what was never in your head: the secret lives on paper, not in memory.

That is worth knowing, and it is not immunity from coercion. Our threat model lists physical coercion among the things Crypt-in does not solve, because no technology does. The honest version of the claim is narrower: the secret is not in a person, so it cannot be extracted from a person. Where the paper is kept remains a human problem, and it is the one you should think hardest about.

Crypt-in is made by lake8.dev, a one-person software house in San Pietro in Casale, Bologna. Developer beta launches 30 September 2026. cryptin.lake8.dev

← Back to journal