ZME1 container ZeroThink CLI .ztz ZEQ-256 equation AES-GCM-256 Password + pattern image Restored on talktoai.org

Two platforms. One equation. Back under one trusted domain.

ZMath is a dual-key encryption system that combines your password with a pattern image to derive strong keys and produce encrypted artifacts in the ZME1 container format. Portable mode also decrypts ZeroThink CLI .ztz files locally, so Agent Zero encrypted files can be restored from the web when you need it. The old external links are no longer required: Portable and Exclusive are now hosted directly under talktoai.org.

ZMath Dual-Key Encryption: ZME1 container, ZEQ-256 derivation, Portable and Exclusive modes.

The two systems

Both tools run under this domain now. No more dependency on the lost external domains.

Portable Mode - decrypt anywhere

Encrypt and decrypt in your browser using the correct password plus the exact pattern image. Portable containers are self-contained, so they can be moved between machines.

  • Client-side ZEQ-256 style derivation from password and pattern image.
  • AES-GCM-256 authenticated encryption.
  • Outputs downloadable ZME1 JSON containers.
  • Decrypts ZeroThink CLI .ztz files and encrypted folder bundles as ZIP downloads.
  • No server policy token required to decrypt.

Exclusive Mode - server-bound access

Exclusive containers use the same password and pattern image model, plus a same-domain ZMath policy token. If the policy endpoint is missing, disabled, or moved away from talktoai.org, decryption fails.

  • Server-bound key factor generated outside public_html.
  • Still encrypts and decrypts file bytes locally in the browser.
  • Designed for controlled, on-site workflows.
  • ZME1 file records that it belongs to the talktoai.org Exclusive lane.

How ZMath protects data

Dual-key derivation

The password and pattern image are processed separately, mixed through a ZEQ-256 style SHA-256 equation, then finalized through HKDF to create an AES-256 key.

ZME1 container

Each ZME1 file stores the encrypted payload, salts, IV, algorithm labels, mode, and metadata required to verify and decrypt later with the same factors.

Authenticated encryption

AES-GCM detects wrong passwords, wrong pattern images, damaged files, and tampering before a bad plaintext file is written.

Client-side first

File bytes are encrypted and decrypted locally in the browser. Exclusive mode contacts the server only for a policy key factor, not to upload your plaintext file.

Important: if you lose the password, exact pattern image, or ZeroThink CLI Z-Pepper, ZMath cannot recover the file. Keep backups of the required factors before using this for anything important.