File vault

Encrypts files and folders with AES-256-GCM. The key is derived from your password – optionally also from a key file and a key that exists only in this browser. Files of any size are processed block by block in the background.

Ready

Drop files or folders hereor click to choose · size is not limited by memory

Choose folder

Password

Repeat password

Key file (if used when encrypting)

Key

Key derivation

Argon2 memory

More memory makes guessing passwords more expensive, but opening the file needs that much free memory too.

Key file (optional, second factor)

Any file (up to 64 MB). Without exactly this file the vault stays shut – even with the right password. Store it apart from the password.

Options

Bind to this deviceThe file can only be opened in this browser on this device – even with the right password.Hide original nameThe encrypted file gets a random name. The real name is stored encrypted inside.Combine everything into one containerPacks all files (with folder structure) into a ZIP and encrypts it as a single file. 4 GB maximum.

Intermediate results live in this browser’s private storage. “Clear selection” deletes them.

Device binding

Important: if the device key is deleted (clearing browser data, another browser, a new device), bound files are lost forever – even with the password. Only a backup of the key can save them.

Password for the key backup

Backup file (.trsr)

How the vault works

Encryption: AES-256-GCM in 1 MiB blocks. Every block is authenticated; truncating, reordering or altering the file is detected.
Key derivation: Argon2id (default: 64 MB, 3 passes) or PBKDF2-SHA-256 with 600,000 rounds, each with a random salt. The password is Unicode-normalised (NFKC) first.
File name, type and modification date are stored encrypted inside. Visible remain size, method, and whether device binding or a key file is required.
Device binding and key file are additionally mixed into the key derivation. Anyone who copies the file needs both.
Limits: weak passwords, malware on the device and lost passwords or keys cannot be compensated by even the best vault. There is no recovery.