pock
██████╗  ██████╗  ██████╗██╗  ██╗
██╔══██╗██╔═══██╗██╔════╝██║ ██╔╝
██████╔╝██║   ██║██║     █████╔╝ 
██╔═══╝ ██║   ██║██║     ██╔═██╗ 
██║     ╚██████╔╝╚██████╗██║  ██╗
╚═╝      ╚═════╝  ╚═════╝╚═╝  ╚═╝
NewEncrypted chat is live: Chat Control-proof messaging→

One key seals it all.

One zero-knowledge identity for your secrets, your conversations, and your terminal. Post-quantum encryption and biometric unlock, with code you can verify yourself. Your plaintext never reaches our servers.

Open pock chat →Download the CLI →
$curl -fsSL pock.sh/install | sh
pock - zsh - 80×24
pock 0.3.0 - secrets, sealed at the edge
type `pock --help` to get started, or `clear` to reset.
$

live demo - try pock --help or pock share .env

Your plaintext never reaches us

Secrets are sealed on your device. We only ever hold ciphertext. See for yourself.

your device

Encrypted here, in your browser, before anything is sent. The key is derived from your passphrase + Secret Key and never leaves this box.

🔒 X-Wing
XChaCha20
-Poly1305
what pock stores
21c5ad520a36ab6b77d14532013fe036a2bfbbab3f063e4a644550a04bfca8721b6813af33753e545e9da0d119fb9ffc91088facf39ba74dc02277d65dd06b74981d2beed81bbd1c2d243b75e6ca9884106590aa2283160251b64d2c80e9487d

Just ciphertext. Your passphrase, key, and plaintext never arrive here. We literally cannot read this.

Try editing the secret and watch the envelope re-seal live. This is what zero-knowledge means in practice.

0
bit keys
XChaCha20-Poly1305
0
ciphers
post-quantum default
0%
in-browser
client-side encryption
0
bytes plaintext
we ever store

// why pock

vault

Zero-knowledge vault

Every secret is encrypted in your browser before it leaves. We store only ciphertext - your keys never reach our servers.

post-quantum

Post-quantum crypto

X-Wing hybrid KEM fuses X25519 with ML-KEM-768. Secure against both classical and quantum adversaries.

passwordless

Biometric unlock

Face ID, Touch ID, Windows Hello, or a security key. WebAuthn PRF derives your vault key on-device. Nothing is transmitted. Nothing stored server-side.

sharing

Secure sharing

Send encrypted secrets to anyone via a link. The decryption key travels a separate channel - Pock never sees the plaintext.

// one key, every surface

vaultpock.sh/vault

Passwords & secrets

A full secret manager, zero installs. Unlock with Face ID, Touch ID, or a passphrase. Every read and write is encrypted client-side - we only ever hold ciphertext.

  • ✓Browse, add, and rotate secrets by project
  • ✓Biometric unlock (Face ID, Touch ID, Hello) or passphrase
  • ✓Project-based organization with per-item history
  • ✓Share with anyone - no account required for recipients
Open the vault →
chatchat.pock.shnew

Private conversations

Servers, channels, and DMs sealed with the same post-quantum keys as your vault. Messages, media, even room names are ciphertext to us - Chat Control-proof, by architecture, not policy.

  • ✓Servers, channels & DMs - all end-to-end encrypted
  • ✓Encrypted media: images and files sealed on your device
  • ✓Even room names are ciphertext - no content scanning is possible
  • ✓The same post-quantum keys as your vault
Open pock chat →Play with the crypto →
clipock vault - pock run

Inject secrets into any process

Pull secrets from the vault and inject them as environment variables in one command. The same pock-core crypto as the web, so CLI and browser are byte-compatible.

$pock vault get prod DB_URL
postgres://user:pass@db.example.com/prod
$pock vault set prod API_KEY sk_live_...
✓ sealed and stored
$pock run -p prod -- node server.js
Server listening on :3000
Download the CLI →

// how a share moves

Two channels. We see neither secret.

Your files are encrypted in the browser. Only ciphertext crosses our edge. The key rides a separate channel straight to your recipient, so holding the link alone, or our storage alone, reveals nothing.

decryption keyseparate channel, never touches our serversciphertextciphertextYouencrypt in browserPock edgeciphertext onlyRecipientdecrypt in browser

Take your keys back.

One zero-knowledge identity covers your secrets, your chat, and your CLI. Post-quantum encryption and biometric unlock, free to start.

Download the CLI