Live demos

Watch it work, in your own browser tab.

Two interactive tutorials that run the real library — the same code you would npm install — with a simulated server drawn along the bottom of the page so you can see exactly what it holds. Nothing is sent anywhere. There is no account, no backend, and no data of yours involved.

Start with tutorial 1 Read the docs instead

Tutorial 1 · 8 steps

A shared group vault, end to end

The place to start. Two people share one page. Create a vault, encrypt a document, admit a colleague, watch them read history from before they joined — then revoke them and watch the door close.

Partway through, an outsider holding the server’s entire dataset tries every key slot and fails. That is the whole argument for this product, and it takes about two minutes to watch.

The backup gate refusing a real vault operation before enrolment
A new member inheriting the full history, verified from genesis
An outsider with all the ciphertext getting nowhere
Revocation as a key rotation, not a permission flag

Open tutorial 1 →

Tutorial 2 · 6 steps

Losing a device, and getting back in

The question every IT team asks second, right after “can you read it?” — because mandatory encryption without a recovery story is just a data-loss machine with good intentions.

Destroy a device completely, try the wrong recovery credential and get refused, then restore from a deliberately stale backup and watch it recover everything that happened after the backup was taken.

A 128-bit recovery credential, generated on the device and shown once
A wrong credential refused by arithmetic — we have no reset path
The same identity restored, so it is the same member, not a new one
Records written after the backup, recovered anyway

Open tutorial 2 →

How to read them

Both pages are laid out the same way. Three things are worth knowing before you click Next.

The panels show what each device holds

They are state inspectors, not logs. In tutorial 1 the row carrying the argument is secrets held: at the end one person has three keys and the removed member has two. That single line is revocation.

The bar along the bottom is the server’s entire world

Four tables — and nothing else. There is no users table and no devices table, because a conforming backend never receives that. Every filled slot is clickable and shows the exact bytes stored.

“Back” rewinds the view, not the protocol

Keys only ever move forward. Each step snapshots the page, and Back repaints an earlier one — so you can re-read a step without the cryptographic state ever going backwards, which it cannot do.

What is real here, and what is staged

These are teaching pages, so it matters that you know which parts are load-bearing.

Real

The actual published library, running unmodified
AES-256-GCM record encryption with per-key usage accounting
Ed25519 signatures and the full membership-chain verification
Argon2id backup derivation at the specification’s baseline cost
The enrolment gate, refusing a genuine vault operation

Staged

The server is an in-memory stand-in, not CircleKey Cloud
Both “devices” are panels in one browser tab
Nothing persists — reload and it is gone
Every name, document and key is fictitious
Tutorial 1 calls the core primitives directly, so the wire view is honest

The demos run entirely offline once loaded. No request leaves the page, nothing is recorded, and there is nothing to sign up for. Use the browser’s network tab if you would rather verify that than take our word for it.

Convinced, or want to poke at it properly?

The same flows run headlessly in the test suite, and the whole library is MPL-2.0 on GitHub. When you are ready to wire it to a real backend, that is twenty lines, and a hosted plan from $29 a month.

Integration docs Cloud & pricing Browse the source