Encrypted letter of instruction Prototype

Write instructions for the people who would have to figure things out, then lock them with a passphrase. It happens inside your browser. We never receive the letter, the passphrase, or the locked file, and this page makes no network requests.

Do NOT type a seed phrase, private key, or wallet password here.A letter of instruction says where things are and what to do, such as “the hardware wallet is in the grey box in the study; call attorney Jane Doe.” It must not contain the secrets themselves. This page tries to catch seed phrases and keys and will refuse to lock them, but that check is best-effort and cannot catch everything.

Prototype. This tool has not had an independent security review. It uses AES-256-GCM with a key derived from your passphrase by PBKDF2-SHA256 (browsers do not yet offer Argon2, so we use a high iteration count). Anyone who guesses your passphrase can open the file, so use a long one and keep it apart from the locked file. If you forget the passphrase, nobody can recover the letter. Do not rely on this as your only copy of anything important. See Trust the code.

Your letter Passphrase (at least 12 characters; several random words work well)

Repeat passphrase

Strength (more is slower to guess and slower to open)

Locked letter (safe to store or email; useless without the passphrase)

The page also clears itself when you close the tab.

Next: set up a full plan with check-ins and a passphrase split into shares.

How hard is it to crack?

Your letter is only as strong as your passphrase

The lock itself (AES-256) is not the weak point. Guessing a random 12-word recovery phrase is a different story from guessing a short passphrase, and the gap is enormous. Here is what a machine making a trillion guesses a second would get against a random 12-word phrase:

But a weak passphrase can be cracked in seconds; a long random one can't. The meter under the passphrase box shows how a real attacker would fare against yours, and the Plan demo can generate a strong one for you.

The real risks are weak passphrases, phishing, and lost shares, not brute-forcing a random key. Quantum computers are a long-term consideration for some algorithms, but they do not change this advice today.

See the math and the guess machine

Opening it without us

A locked letter should never depend on this website. The format is documented on Trust the code, with a short script that opens it using standard tools.