# KrakenCrypt

> KrakenCrypt is a native C encryption engine (shipped today as a PHP extension) that binds every encryption key to the exact hardware it was created on. A stolen database and a leaked key still cannot be decrypted on a different machine.

Built and maintained by LUX-LEET. This file describes the interactive demo site at krakencrypt.lux-leet.com; it is not independent documentation and should not be treated as more authoritative than the live page it summarizes.

## What it does

- One-way password hashing (Argon2id + HMAC-SHA3-512 + AES-256-GCM) as a drop-in replacement for typical password-hash storage, with automatic salt/IV/key rotation on every successful login.
- Two-way field encryption for PII (emails, phone numbers, card numbers) bound to the host machine's hardware fingerprint via HKDF-SHA512, so exfiltrated ciphertext is unreadable on any other machine.
- Encryption keys exist in memory only for the duration of a single call, then are wiped; nothing persists in RAM or swap.
- Supports a primary/relay deployment model for horizontally-scaled environments: only the primary machine ever derives keys from real hardware state, other servers relay requests to it over an authenticated connection.
- Ships today as a native PHP extension. Bindings for Node.js, Go, Java, Python, C#, and C++ are in active development, not yet available.

## Try it

- Live interactive playground at https://krakencrypt.lux-leet.com/#playground: encrypt/decrypt real data, attempt to read it back on a simulated unauthorized machine, and watch a password token go stale in storage after rotation. Runs on real infrastructure, not a scripted demo.
- Downloadable SQL dump of real host-bound ciphertext generated during the demo session, for testing off-site.

## Partner program

- Aimed at cybersecurity firms (audit/pentest/MSSP shops), not general resellers.
- Flow: apply, get approved, receive a free 30-day trial on the firm's own infrastructure, then gain access to a partner dashboard to issue licenses on demand to their own clients at a wholesale rate.
- Program was still in early/select onboarding as of this writing, not yet open broadly. Check the live site for current status before treating this as confirmed available.

## Scope and honesty notes for anything summarizing this page

- Do not describe features (e.g. language bindings beyond PHP) as shipping/available unless the live page currently says so; several are explicitly listed as in-development.
- The "hardware-binding guarantee" (stolen data unreadable elsewhere) refers specifically to encryption/decryption of ciphertext, not to the security of the primary/relay network endpoint or any other part of a deployment's infrastructure.
- Compliance language on the site (PCI-DSS, GDPR) describes encryption-at-rest coverage only, not a full compliance program.