Docs

Where the docs live.

OC Vault's docs are split on purpose: this site hosts the product, the unified docs site hosts the SDK and integration reference, and the protocol repository hosts the normative spec. Three places, one family.

Open your vault Read the reference

ochk.io/docs/vaultQuickstart, the security model, team vaults, the developer platform, the browser extension and the @orangecheck/vault-core API. This is where developers go.Open the reference (opens in a new tab)
oc-lock-protocolThe OC Lock spec: SPEC.md, PROTOCOL.md, WHY.md, SECURITY.md and test vectors. OC Vault encrypts with its primitives (X25519, HKDF-SHA256, AES-256-GCM), and your passphrase holds your vault key. A wallet account can also export an entry as one of the spec's envelopes: a .lock file signed by your wallet and sealed to your OC Lock devices.Read the spec (opens in a new tab)
lock.ochk.ioThe reference web client for OC Lock. It seals a message or file to a Bitcoin address, so only the person who holds that address can open it. To send a secret to someone else, use Lock.Open lock (opens in a new tab)

Orientation

Quick answers.

Who is OC Vault for?

Anyone who wants passwords, TOTP codes, API keys and recovery codes encrypted in their browser, with sync paid in sats rather than by card. You sign in to an orangecheck account with email, Google, GitHub or a Bitcoin wallet. It is not a place for your seed (seeds belong on metal, offline).

What does Bitcoin do in OC Vault?

Three things. You pay for cloud sync on-chain: each invoice is a fresh address from a watch-only xpub, so the payment server we run holds no key that can spend what you pay. You can sign in, and confirm it's you before a sensitive change, with a Bitcoin wallet (BIP-322) instead of email, Google or GitHub. And with a wallet you can export an entry as a .lock file: an OC Lock envelope your wallet signs, sealed to your own OC Lock devices, that anyone can check offline and only those devices can open. Your wallet does not encrypt or open your vault; your passphrase does.

What's the trust model?

orangecheck holds ciphertext only. Your entries open with your vault passphrase, or your recovery code, and neither ever reaches us. Your sign-in only fetches the ciphertext.

Is this the same as a hardware wallet?

No. Your wallet protects your sats and can be your sign-in. It does not decrypt your vault; your passphrase does.

Can I self-host?

Not the sync service yet. You can skip the cloud entirely: the free tier keeps everything in your browser, and an encrypted backup file restores anywhere. Cloud sync on vault.ochk.io is the paid convenience.