My files
New
Upload
Tax documents
8 items
passport.pdf
1.4 MB
trip-2026.jpg
3.2 MB
Work
23 items
contract.docx
88 KB
backup-keys.txt
2 KB
Vault Desk is an end-to-end encrypted drive. Everything is encrypted on your device — the server only ever stores ciphertext and wrapped keys. Not even we can read your files.
Upload, organize, share, and recover your files. Every operation happens over data that's already encrypted on your device.
Each file is encrypted client-side with XChaCha20-Poly1305 before it's uploaded. The server stores only ciphertext.
OPAQUE means your password never leaves your device — not even hashed. The server can authenticate you without ever seeing it.
Share a file and its key is sealed to the recipient's public key. Revoke access or change roles whenever you like.
Share with anyone. The decryption key lives in the link itself (after the #) and never reaches our servers. Add a password and an expiry.
Recipients' public keys are published in a tamper-evident, append-only log — so the server can't quietly swap in a key it controls.
Forget your password? A one-time recovery key restores access — without us ever holding the keys that decrypt your files.
Three steps, and at no point does the server hold anything it can decrypt.
Your password derives your keys locally. Files are encrypted in the browser before a single byte is uploaded.
The server receives encrypted blobs and wrapped keys it has no way to open. Filenames are encrypted too.
Sign in from any device to unwrap your keys and decrypt locally. The server never sees your files or your password.
Vault Desk assumes the server can be compromised. Because keys are derived and held only on your devices, an attacker who steals the entire database gets encrypted blobs and wrapped keys — useless without your password.
A fast, modern drive in your browser. Built with Next.js and React — no plugins, nothing to install.
iOS and Android share the exact same crypto core, so encryption behaves identically — byte for byte — across platforms.
Start free. Upgrade when you need more room. Encryption is the same on every plan — total.
For getting started.
For everyday peace of mind.
For organizations.
Illustrative pricing — adjust to your plans.
It means we have zero knowledge of your file contents. Encryption and decryption happen entirely on your device. The servers only ever hold ciphertext and keys that are themselves encrypted (“wrapped”), so no one operating Vault Desk can read your files.
At sign-up you get a one-time recovery key. It independently unlocks your account and re-wraps your keys under a new password — all on your device. Because we never hold your keys, keep that recovery key somewhere safe: it's the only backup.
No. Our threat model assumes the server may be compromised. Even with full access to the database, an attacker sees only encrypted blobs and wrapped keys — unusable without your password, which is never transmitted.
Yes. Vault Desk uses standard, well-reviewed primitives from libsodium (XChaCha20-Poly1305, X25519, Ed25519, Argon2id) in a single, small crypto core shared across web and mobile — deliberately easy to audit.
Encrypted blobs live in object storage; encrypted metadata and wrapped keys live in the database. You can also self-host the whole stack — the data is meaningless without the keys only you hold.
Create your encrypted vault in under a minute. Free to start, private by design — and only you ever hold the keys.