There’s an irony in modern cybersecurity that we rarely talk about.
We’ve become remarkably good at protecting data from everyone except ourselves.
A few days ago I was testing the AutoFill feature in Krypt, the offline password manager I’ve been building. Like any developer, I wanted to see how it behaved with real services. I created an account on one of them, saved the credentials in Krypt and started working through the login flow.
The mobile application accepted my credentials without complaint. The website, however, informed me that the account had been suspended due to a potential policy violation.
The account had never been used.
Whether it was a temporary glitch, an overzealous anti-abuse system or simply a backend inconsistency doesn’t really matter. False positives happen, especially on large online platforms. What interested me wasn’t the suspension itself. It was the question it raised.
We spend a lot of time talking about encryption, zero-knowledge architecture and military-grade algorithms. Those technologies answer an important question: Can someone else read my data?
But they don’t answer another question that may be even more important: Can I still access it?
If your encrypted vault sits behind an online account, access depends on more than your password. It also depends on authentication servers, account verification, automated abuse detection and the systems standing between you and your data.
Imagine renting a bank vault with an unbreakable lock. One morning you arrive with the correct key, only to be told that your access has been temporarily suspended while the bank reviews your account. Your valuables remain perfectly secure—you just can’t reach them.
That’s essentially the trade-off we accept with cloud software. In exchange for effortless synchronisation and backups, we also accept that access to our own data depends on infrastructure we don’t control.
The question isn’t whether cloud software is good or bad. It is whether security should ever depend on someone else’s permission.
That realisation shaped Krypt from the beginning. I didn’t want opening your vault to depend on an account, a subscription check or a remote authentication service. I wanted it to depend on exactly two things: your device and your PIN.
Everything else is optional.
Offline software isn’t the right choice for everyone. You give up automatic sync and take responsibility for your own backups. Those are real compromises.
But in return, you gain something that’s becoming surprisingly uncommon: the confidence that the only permission required to unlock your vault is your own.