SealbreakUNSEAL COMPANION

UNSEAL COMPANION FOR OPENBAO & VAULT

Unlock OpenBao or Vault with Face ID.

Sealbreak keeps one unseal share protected on your iPhone and sends it to your server only after Face ID.

Download Sealbreak on the App Store View on GitHub

Open source · GPL-3.0 · Join the TestFlight beta

HOW IT WORKS

WHAT SEALBREAK DOES

Your unseal share, ready when you need it.

Sealbreak setup with a Shamir share added and the Protect with Face ID button.

Set up once

Add your server and protect one unseal share with Face ID.

Sealbreak showing a sealed OpenBao server and the Unseal with Face ID button.

Approve with Face ID

Tap Unseal, then use Face ID to allow access to your share.

Sealbreak showing an unsealed OpenBao server, Server is available, and the Check status button.

Check the result

Sealbreak sends your share to the server and checks whether it is still sealed.

BUILT FOR TRUST

Security you can verify.

Device-bound storage

Your share is stored in the iOS Keychain on this iPhone. Sealbreak does not sync it to the cloud or offer an export option.

Face ID required

Face ID is required before Sealbreak can read your stored share.

Direct connection

Sealbreak connects directly to the OpenBao or Vault endpoint you configure. There is no Sealbreak relay.

Open source

The source code and threat model are public, including security assumptions and known risks.

Read the threat modelBrowse the source