The vault on your desktop: Argon2id and a profile that resists guessing

One profile

Everything the desktop knows about you is in a single encrypted file: wallets, their addresses and labels, the address book, network settings, pairings with your phone, and, for wallets that are not air-gapped, the seeds they use. It opens with your password, on the machine that created it, and it is written with the care a wallet file deserves.

Argon2id, and why memory-hard matters

A password alone is a weak secret. People choose short ones, and a fast computer can try billions of guesses per second against a cheap hash. The defence is to make each guess expensive, and to make it expensive in a way that specialised hardware cannot shortcut.

AirNox Wallet stretches your password with Argon2id, the winner of the Password Hashing Competition and the current recommendation for exactly this job. Argon2id is memory-hard: computing it requires a large block of memory for the whole duration, not just processor time. A graphics card has thousands of cores but not thousands of large memory blocks, so the usual trick of running guesses in parallel on a GPU gains very little. Purpose-built hardware fares no better.

Calibrated to your machine

The cost is not a fixed number. When the profile is created, the wallet measures your computer and tunes Argon2id so that one computation takes about a second there, using a large slice of memory. On a fast workstation that means more work per guess; on a small single-board computer it means the parameters fit what the hardware has, while still taking about a second.

The asymmetry is the whole point. You pay the cost once per unlock, and a second is nothing. Someone guessing pays it for every guess. A million guesses is a million seconds of one machine's full attention, with a large memory footprint each, and they cannot farm the work out to a rack of graphics cards to make it cheap.

Bound to the machine

The profile is tied to the computer that created it, and on machines with a TPM 2.0 security chip that binding is anchored in the chip. Copied to another machine, the file does not open with the password alone. That turns a stolen file into a much harder problem than a stolen file usually is.

The rest of the vault

Growing delays. After wrong attempts, the wait before the next try grows. A guess that is already expensive becomes expensive and slow.

Idle auto-lock. Walk away and the profile locks itself. Coming back costs you one password.

Locked memory. While the profile is open, its secrets live in memory the operating system is told not to swap to disk. A seed stays there only while it is needed and is wiped straight after, and everything is wiped when the wallet closes or locks.

No screen captures. The wallet keeps its windows out of screenshots and screen recordings, so a capture tool on the same computer does not see what you see.

Safe writes. Every save is atomic: the new file is written in full and then swapped into place, so a crash mid-write leaves you with the previous good version, never a half-written one. A damaged file is set aside with its name marked, never silently used.

Owner-only permissions. The profile is readable by your user account and nobody else on the machine.

What it protects, and what it does not

For an air-gapped wallet, the desktop profile holds addresses and settings, and the keys stay on the phone. The vault protects your privacy and your configuration. For a wallet whose seed lives on the desktop, the vault is what stands between an attacker with your file and your funds, and that is why it is built the way it is. That is also why AirNox Wallet on its own, with the seed in this vault, is a sound choice for everyday operations, while AirGap remains the ultimate layer for what matters most. In both cases, a strong password is yours to choose. The vault makes every guess cost. It cannot make a short password long.