KeepsakeTravel Mode
At a border, on hotel Wi-Fi, or with a dead SIM: your travel documents open with a short PIN, work fully offline, and self-destruct when the trip ends.
The problem
Travel is when you most need your documents and least want to carry your whole digital life. Typing a long vault password over an airport shoulder-surfer's view is bad; being forced to unlock everything at a checkpoint is worse; and roaming data is never there when the hotel asks for your insurance certificate.
How Keepsake solves it
✈️Pack once, before you leave
Pick the documents for the trip and set an end date. Keepsake seals them into a separate capsule on the device — the main vault stays locked and untouchable.
🔢PIN, not password
The capsule opens with a short PIN — usable one-handed at a counter. Five wrong attempts wipe the capsule (never the vault), then it can simply be re-packed from home.
⌛Expires by itself
When the trip end date passes, the capsule is purged automatically at next app start. Nothing sensitive lingers on the phone you dropped in a taxi.
Under the hood — capsule crypto
- The capsule key is random, wrapped by Argon2id(PIN) — never by your vault password, which is not derivable from anything in the capsule.
- On Android the wrap adds a hardware-keystore second factor, so a copied capsule folder is useless off the device; Windows uses DPAPI per-user binding; the browser requires a longer PIN instead.
- Each document blob is AEAD-bound to its index in the capsule manifest — items cannot be swapped, dropped or reordered without detection.
- Wipe-on-5-wrong-PINs and expiry purge run locally; a capsule never phones home, because there is no home to phone.
Trust through specificity: the full crypto design is documented on the security page.
Questions
Is Travel Mode available on iPhone?
Yes, through the installable web app — the capsule works offline via the service worker, which is exactly the border-crossing scenario it was built for.
Does wiping the capsule affect my vault?
Never. The capsule holds copies. Wipe it, lose the phone, let it expire — your vault at home is untouched.