The encrypted vault your family will actually need.

Every file is encrypted in your browser before it ever touches Henedo’s servers. A random 256-bit File Encryption Key (FEK) is generated per file, used to AES-256-GCM encrypt the payload, and then wrapped with your Master Key. Your Master Key is derived on your device from your passphrase plus a device-bound Account Secret Key.

The server sees ciphertext, encrypted filenames, and encrypted folder names, nothing else. There is no backdoor, no master-key escrow, and no employee bypass. See the full architecture including our zero-knowledge model, canary-blob breach detection, and binary transparency verification.

The vault stores any file format, but the Henedo Journal turns the same encryption envelope into a daily life chronicle: voice notes (encrypted WebM/Opus or MP4/AAC), video messages (encrypted MP4/H.264), dated text entries, photos. Voice for the moments you cannot be there. Video for the wisdom only you can pass on. Encrypted client-side under the same Master Key as your documents, scheduled to deliver to the people you choose.

Click any file or folder in your vault and attach a written note (markdown supported, autosaves as you type) plus an optional voice memo recorded right in the browser. Up to 30 minutes of audio per file. Both the text and the audio are encrypted client-side under the same Master Key as the file itself, so the server is blind to all three.

This is the layer that turns a folder of documents into a *narrated archive*. Why you bought the house the day you scanned the deed. Who's in the family photo. What your insurance contact is called. Inheritors don't just receive "Insurance_2024.pdf". They hear the voice of the person who saved it, explaining what it is.

Notes and voice memos travel with the file automatically. When you assign a trusted contact access to a folder, the note text and the voice memo's decryption key are re-wrapped under that contact's COTK alongside the file itself. When you seal a file into the Eternal Vault, both the note and the voice are re-encrypted under the vault's EVAK and bound into the SHA3-512 hash that the hybrid Ed25519 + ML-DSA-65 (NIST FIPS 204) signature covers, so they inherit the same post-quantum protection as the rest of the sealed vault, for the full preservation term recorded on your purchase.

Free on every paid tier. No limits per account. The grid view shows a small preview of each note inline; the file preview modal shows the full note as a glassmorphic overlay you can read while looking at the photo or document itself. One click to edit, autosave on blur, no separate app to remember.

A vault nobody can open is just a tomb. Henedo delivers trusted-contact keys the day you designate someone, not at your death. The platform is a simple boolean gate: before Trusted Delivery fires, the server refuses to serve encrypted data. After, it does. The keys your family holds are valid from day one.