Passkeys and unlock

Sign in to Encloq.Unlock on your device.

Encloq is built around passkeys: credentials kept on your device, in a password manager or on a security key, bound to Encloq and confirmed with your fingerprint, face or screen lock.

Your data and your encryption key are stored with Encloq, both sealed. Your passkey is on your device.

Signing in proves to Encloq that it is you and opens your account, with your data still encrypted. Unlocking is a separate step that happens only on your device: your passkey opens your encryption key there, and the key decrypts your files and messages.

Your encryption key is stored with Encloq, but only sealed, so it is there on every device you unlock. What opens it comes from the passkey itself: through the WebAuthn PRF extension, your passkey computes a secret that only that passkey can produce, each time you confirm. The secret is used on your device and is never sent to Encloq, so Encloq holds your key but cannot open it.

Only a passkey that supports PRF can protect an encryption key. Encloq checks this when you add one and tells you before anything changes. Each passkey with encryption access opens its own sealed copy of your key, so removing one leaves the others working.

Passkeys come first, but Encloq also offers a password as a fallback for devices that cannot use passkeys. Your password never leaves your device, and it can hold a sealed copy of your key too. It is still weaker than a passkey: a password can be guessed, reused or phished.

Keep a second passkey.

Encloq cannot recover your encryption key. If no passkey or password that holds it is left, a new passkey can still sign you in, but your existing files and messages stay encrypted. Set up a second passkey with encryption access, for example on your phone, while you still have access.

Adding a device

A new passkey can sign you in right away. It decrypts only after you copy your key to it, confirming first with a passkey or password that already has the key and then with the new passkey.

Encloq emails you about security changes, for example when a passkey or password is added or removed. If a device is lost, remove its passkey and end its session from a device you still have.

Locking

Encloq locks when you choose Lock, when you close it, and after a period of inactivity you set, with a warning first. Locking discards your keys from memory and clears decrypted content. Uploads and downloads you let continue keep only the keys they need, until they finish. Unlocking again needs a passkey, or a password that holds your key.

Passwords, only as a fallback

For a device that cannot use passkeys, you can add a password, ideally together with an authenticator app. It opens your data only if you copy your key to it. Otherwise it signs you in, and your files and messages stay locked until a passkey unlocks them.

Encloq never receives the password itself. Your device turns it into two separate values with a deliberately slow calculation: one signs you in, the other seals the copy of your key and stays on your device.

Unlike a passkey’s secret, a password can be guessed. Someone who obtained the sealed copy could try passwords against it without asking Encloq, and an authenticator app protects sign-in but not that copy. The slow calculation makes each guess expensive, not impossible. Use a long password you use nowhere else, and add one only when you really need it.

Passkeys guide

Files

Encrypted before upload.Checked as you read.

Every file is encrypted on your device before it leaves, each with its own key. Its name, type and other details are encrypted too, so Encloq stores pieces it cannot read.

A file on your device, readable to you.

Previews open on your device as well. PDFs, videos and audio fetch and decrypt only the parts you view, so even large files, up to 250 GiB each, open without downloading everything first. Every piece is checked as it is decrypted. A piece that was altered is refused, never shown.

Thumbnails, text recognition for search, the document scanner and the built-in editors run on your device too. What you save in an editor is encrypted there, and earlier versions stay in the version history. Nothing on Encloq’s servers looks inside your files.

Hidden metadata

Before encrypting, Encloq removes hidden details from photos, videos, audio, PDFs and Word, Excel and PowerPoint files, such as where a photo was taken, device serial numbers, author information and company names. The camera model, the time a photo was taken and the names on comments are kept.

If a file that may carry such details cannot be rewritten safely, Encloq uploads it as it is and tells you.

Sharing a file

When you share a file in a conversation, its key travels inside the end-to-end encrypted conversation. With file access controls in Encloq Pro, you decide whether people can download or forward it. Copies that already went out stay readable.

Conversations

End-to-end encrypted.Post-quantum key exchange.

Messages, voice notes and attachments are encrypted on the sender’s device for the devices in the conversation. Encloq relays and stores them without being able to read them.

You want to send Alex a message.

Before devices exchange messages, they agree on keys in two ways at once: with P-521 elliptic-curve Diffie-Hellman, an established method, and with ML-KEM-1024, a NIST standard designed to withstand quantum computers. Both results go into the key, so it stays secret as long as either method holds.

That answers “harvest now, decrypt later”: someone who copies encrypted messages today and waits for a capable quantum computer would still have to break ML-KEM.

Invitations

The link and the key.On separate paths.

You can invite people who are not on Encloq yet. Encloq emails them a link, but the access key that unlocks the invitation never passes through Encloq.

You invite someone who is not on Encloq yet.

Share the key another way, for example by phone, or send a secure link or QR code that already includes it through a channel you trust. Your guest signs in or creates an account with the invited address, and their device uses the key to unlock the conversation.

Until your guest joins, the keys of their invitation come from your device, so you could read what is sent to them. Encloq shows this in the conversation, and it ends once they join.

30 days: Then an unused invitation expires and the invited address is removed.
Renew: Creates a new access key. The old one stops working.
Revoke: The invitation no longer opens the conversation.

Guest invites guide

Signatures and identity

Know who signed.And exactly what.

When someone signs a PDF in Encloq, their device signs a fingerprint of that exact file, together with who signed and when. Two methods sign at once, ML-DSA-87 and ECDSA P-521, and both must check out.

Alex is about to sign Agreement.pdf in Encloq.

Everyone the document is shared with sees who signed it. If the file changes afterwards, checking it shows that the signature no longer matches. Signing adds a new version, and the original stays in the version history.

Messages can carry the same signatures. Sign a single message when it should be provable, or ask for a signed read confirmation: the recipient’s app shows the message once they sign that they have read it, and the confirmation comes back to you.

Checking who you work with

When you add a contact, Encloq remembers their security key and warns you if it ever changes. To be sure it is really them, compare their key picture and three words, then the full key, in person or by phone.

Signatures from people you have not added are checked against the security key Encloq publishes for them. Adding and comparing a contact makes that check independent of Encloq.

What these signatures are not

Encloq signatures are not qualified electronic signatures. The signing time comes from the signer’s device, not from a trusted timestamp service.

Data boundary

What we can’t read.And what we need to know.

End-to-end encryption protects content. To deliver it, Encloq still needs some information about accounts and exchanges. This is where the line runs.

Encrypted on your devices

Encloq can’t read it.

Files: Contents, names, types and other details, and the names of your folders.
Conversations: Messages, voice notes, reactions and conversation titles.
Signatures: Signatures on documents and messages, read confirmations and your saved signatures.
Previews and search: Thumbnails and your search index, both created on your devices.
Drafts: Messages you have not sent yet, kept across your devices.
Keys: Your encryption keys, sealed by your passkeys or a password, and the access keys of your invitations.

Visible to Encloq

Needed to run the service.

Your account: Email address, username, display name, language and time zone.
Conversations: Who is in a conversation, who manages it and who added whom.
Activity: Who sends to whom and when, how large it is, whether it was seen and, if you show your online status, who is typing.
Files: Their size, folders and versions, who they are shared with, and whether they may be downloaded or forwarded.
Devices and sign-in: The public part and model of your passkeys, and the device type, operating system, browser and latest IP address of each session.
Invitations: The invited email address, until the invitation is accepted, expires or is revoked.
Billing: Name, address, VAT number, plan and a summary of your payment method. Encloq does not store full card numbers.

Building blocks

Established standards.Combined with care.

Encloq builds on published, widely reviewed algorithms rather than inventing its own. Where it matters for the long term, it combines a proven classical method with a post-quantum one.

Cryptographic building blocks
Purpose	Standard	What it does
Content encryption	AES-256-GCM	Encrypts files and messages and detects any change to them.
Key exchange	ML-KEM-1024 + ECDH P-521	Agrees on keys between devices. Hybrid: the key stays secret as long as either method holds.
Signatures	ML-DSA-87 + ECDSA P-521	Signs identities, devices, documents and messages. Hybrid: both signatures must verify.
Sign-in and unlock	WebAuthn passkeys with PRF	Phishing-resistant sign-in bound to Encloq. Through the PRF extension, a passkey also computes the secret that opens your encryption key on your device.
Transport	TLS	Protects every connection between your device and Encloq.

ML-KEM-1024 and ML-DSA-87 are NIST post-quantum standards at security category 5, the highest. Post-quantum protection covers key exchange and signatures. Passkey sign-in and TLS use today’s established cryptography.

Limits and shared responsibility

What encryption can’t do.Said plainly.

Strong encryption is one part of protecting confidential work. These are the boundaries we want you to know before you rely on it.

Devices and code must be trustworthy.
Encloq encrypts in the app running on your device, so you rely on that device and on the app code your browser loads. Malware or a compromised browser can see what you can see.
Recipients can keep what they can read.
Anyone you share with can save, copy, print or photograph it. Revoking access, file permissions and one-time messages limit what happens in Encloq, not copies already made.
A lost key stays lost.
If no passkey or password that holds your key is left, Encloq cannot recover your encrypted content. Keep a second passkey.
Some information stays visible.
Encloq sees what it needs to run the service, such as who exchanges with whom and when. The data boundary above lists it.
This page is not a certificate.
It describes how Encloq works today. It is not an independent audit, and using Encloq does not by itself make your work compliant with a particular rule.

We keep your work.
Not the keys to read it.