Corgi VaultOpen a backup without the app
Your photos should outlive any app, including ours. This page opens a Corgi Vault backup with your recovery key, right in your browser. Nothing is uploaded, and it works with your connection turned off once the page has loaded.
The format, in full
No secrets in the design. Anyone can write their own tool from this.
- Backup file:
CVB1, then a UInt32 length and JSON header (wrappedKey,itemCount,created), then a UInt32 length and the sealed index, then for each index entry in order: a UInt64 length and sealed file, a UInt64 length and sealed thumbnail (0 when none). All integers are big-endian. - Wrapped key: 16 byte salt, then AES-256-GCM (12 byte nonce, ciphertext, 16 byte tag) of the 32 byte vault key. The wrapping key is PBKDF2-HMAC-SHA256, 300,000 rounds, of the recovery key in capitals without dashes.
- Sealed file:
CVF1, then chunks of up to 1 MB of plaintext, each a UInt32 length and AES-256-GCM box. The additional data is the chunk number (UInt64) and one byte set to 1 on the last chunk, so chunks can't be reordered or cut off. - Index: JSON list of items:
id,kind,name,size,created,isVideo, and optionalalbum,trashedAt,liveVideoOf.
Read the code: open-core.js. It has no dependencies and makes no network requests.