An Encryption Engine That Refuses to Work Anywhere Else
An encryption engine that binds every key to the exact server that created it. This ensures a stolen database and a stolen master key still are not enough to decrypt anything.
Most encryption tooling makes a dangerous assumption. It treats simply "having the right key" as sufficient proof someone is allowed to decrypt something. But the most common real world breach pattern is not a hacker owning your live server. It is data only exfiltration. A leaked backup file, a misconfigured cloud bucket, a stolen credential set. Often, the encryption key is sitting right next to the data it protects. If possessing the key is enough on its own, one leaked key means every record it ever touched is compromised at once. We needed a better approach for our own products, and for future client work. We needed an encryption architecture where the key alone would not be enough.
We built KrakenCrypt. This is a native C PHP extension for password hashing and PII encryption where every key is cryptographically bound to the specific host that created it. The key itself is derived from that machine's own OS level identifier.
What this means in practice is a stolen database and a stolen master key together still are not sufficient to decrypt anything without the originating host. Furthermore, password hashes and PII ciphertext both rotate to a fresh value automatically on every successful use. This means even a value that was exposed at some point keeps shrinking its own exposure window over time. KrakenCrypt also scales horizontally through a primary relay architecture. This allows a load balanced fleet to share one host bound identity instead of every node holding real key material.
The core claim is proven, not asserted. The automated test suite includes a direct proof that a token created with host binding enabled genuinely fails to verify or decrypt once moved to a different machine. This is the exact "stolen data, stolen key, still cannot read it" scenario the product is built around. Twenty automated regression tests now cover password hashing, PII encryption and rotation, host binding rejection, key migration, horizontal scaling, and native key resolution. It is live in production with a public interactive demo where visitors are invited to try to break it themselves.