The offline-first password manager and built-in 2FA authenticator with client-side Argon2id encryption and zero cloud dependency.
Arca Interactive Vault
StrongBox Locked/Unlocked
https://github.com
Core Security Pillars
No Google login, no telemetry beacons, and zero host-page DOM injection. Interact with each architecture module below.
100% offline by default. When you opt into cross-device sync, our self-hostable Rust Blind Relay stores only 256-byte padded XChaCha20-Poly1305 blobs and merges updates via Hybrid Logical Clock (HLC) CRDTs.
Generate RFC 6238 6-digit and 8-digit TOTP codes with a live 30-second countdown ring and enroll 2FA QR codes offline straight from your active tab.
Unlock your vault in milliseconds using hardware-backed WebAuthn PRF on desktop or Secure Enclave / StrongBox on mobile, protected by strict 3-strike fallback.
Licensed under AGPL-3.0 with deterministic reproducible builds (SOURCE_DATE_EPOCH). Autofill verifies 5 DOM security invariants before populating any field.
Simple 3-Step Workflow
Click any step below to inspect the underlying local cryptographic operation.
Available for Chrome, Brave & Android (com.pixra.arca)
100% offline-first, audited open-source cryptography, zero subscriptions.
Architecture & Trust
Argon2id and XChaCha20-Poly1305 without requiring an email address, cloud account, or central server.
ISO/IEC 7816-4 to fixed 256-byte blocks before encryption, hiding credential lengths. Changes are signed with your device's Ed25519 key and merged conflict-free via Hybrid Logical Clock (HLC) CRDTs.
GNU AGPL-3.0 with deterministic builds (SOURCE_DATE_EPOCH) so you can self-host the lightweight Rust relay in Docker and verify release binaries bit-for-bit.
No telemetry, analytics, or personal identifiers.
Never sold, rented, or shared with third parties.
Argon2id + XChaCha20-Poly1305 hardware protected.
What we cannot see, we cannot compromise. Arca requires no email registration, no account creation, and communicates with zero tracking or telemetry servers.
All vault records are encrypted locally using Argon2id (64 MiB, t=3, p=4) and XChaCha20-Poly1305 with 256-byte block padding (ISO/IEC 7816-4). Contact: security@pixra.dev.
Once data or an account is deleted, it is permanently wiped with PRAGMA secure_delete = ON and is mathematically unrecoverable (0-day retention).