Face Vault is a secure biometric file vault. No passwords, no tokens — users unlock their documents with a live face scan, verified by a challenge-response liveness protocol, while every failed attempt is captured, logged and served to the administrator as forensic evidence.
81% of data breaches trace back to weak or stolen passwords (Verizon, 2023). Credentials can be phished, brute-forced or shared — a face cannot. Yet most facial-recognition products stop at authentication: they neither detect intrusion attempts nor keep the visual evidence needed for incident response. Face Vault closes both gaps in a single system.
Every unlock is a live, server-verified interaction — a captured frame set can never be replayed.
The server issues a single-use challenge — blink, turn left, turn right, or smile — valid for just 60 seconds. The action is chosen randomly per attempt, so an attacker cannot pre-record a response.
The browser captures a short frame burst. The server runs face detection on every frame, verifies identity consistency between frames, confirms the requested motion actually happened, and rejects static or replayed imagery.
The verified embedding is compared against that user's stored templates with a single vectorized cosine match. Pass, and the vault opens — the new embedding also feeds adaptive learning. Fail, and the frame goes straight to the intruder log.
Four randomized actions, 60-second single-use challenges, per-frame quality gates and a no-motion guard defeat printed photos and video replays.
Username-gated matching means constant-time lookups and no account enumeration — unknown users and failed matches get the same Access denied.
Each successful login appends the fresh embedding to the user's profile (capped at 30, FIFO), so beards, glasses and aging never force re-enrolment.
Every failed attempt with a usable face writes a JPEG snapshot plus a database record — timestamp, claimed username and match distance — with a 30-day privacy-bounded retention window.
A live admin dashboard with success-rate and confidence analytics, a chronological access history and a click-to-enlarge intruder gallery for incident review.
CSRF tokens on every state change, per-IP rate limits, a 15-minute admin lockout after ten failures, PBKDF2-hashed credentials and HttpOnly / SameSite session cookies.
Dark glass panels, one accent for primary actions, red for privileged ones — designed to keep the focus on the webcam preview.
The entry point pairs a username field with a live webcam preview framed by the unlock ring. One tap on Unlock triggers the full liveness-then-match sequence.
New users prove they are a live person before an account exists: the same challenge-response protocol guards enrolment, and the verified embedding becomes the first stored template.
After a verified unlock, the user lands in their private vault: drag-and-drop uploads on the left, the stored document grid on the right. Ownership checks return HTTP 403 for any cross-user access.
The administrative gate is deliberately styled as a different mode of access. Credentials are checked against a PBKDF2-SHA-256 hash — the plaintext password is discarded at startup and there is no default credential to exploit.
The metric ribbon summarizes enrolled users, success rate, average match confidence and intrusion count. Below it, the live access history and the intruder gallery turn failed attempts into reviewable evidence.
Every face is mapped to a 512-dimensional ArcFace vector, L2-normalised so that similarity reduces to a single dot product. A registered user's embeddings form a tight cluster; an intruder's vector lands far outside it.
The acceptance threshold is deliberately biased toward a near-zero False Acceptance Rate — ambient lighting drops or awkward angles fail safe to access denied, never to a breach.
The same verification engine that guards the vault doubles as a campus attendance system. At the start of a lecture, each student checks in with a live face scan — the liveness challenge makes it impossible to sign in with a photo of a classmate, and every record carries a timestamp and a match score.
Automated pytest coverage of every public endpoint, plus manual trials across lighting conditions, spectacles and deliberate presentation attacks.
The entire system runs as one Python process on commodity hardware — installable by any examiner without specialised equipment.