Secure Vault

📄 Technical paper: SecureVault_Technical_Paper_v3.5.0.pdf · Cite on Zenodo

Local-first file encryption for Windows, secured by a physical USB key instead of a password.

⚠️ v3.5.0 includes a breaking security fix — see CHANGELOG.md before updating from an earlier version.

---

Table of Contents

• What this is
• Why a USB key instead of a password
• Features
• Installation
• First-time setup
• Using Secure Vault
  • Encrypting a file
  • Decrypting a file
  • Registering a USB key
  • Viewing registered devices
  • Backups
  • Restoring a file
  • Email alerts (Option 7)
  • Right-click integration
• Command-line usage
• Configuration files
• Building the installer from source
• Security notes
• Troubleshooting
• License

---

What this is

Secure Vault encrypts individual files (or folders) on your Windows machine using AES-256-GCM. Instead of protecting the encryption key with just a password, the key is generated randomly and stored on a USB flash drive you choose. To decrypt anything later, that same USB drive has to be physically plugged in.

Why a USB key instead of a password

Passwords can be guessed, phished, keylogged, or brute-forced. A physical key can't be remotely stolen the way a password can. Trade-offs to understand before you rely on this:

• If someone steals your laptop but not your USB drive, they cannot decrypt your files.
• There is nothing to type, remember, or leak.
• There is no password reset. If you lose the USB drive and don't have a backup of the key file on it, anything encrypted with it is permanently unrecoverable. Treat that drive like a physical house key — know where it is at all times, and consider keeping a backup copy of the key file itself in a safe second location.

Features

• AES-256-GCM encryption with scrypt key derivation
• USB-based master key, plus optional per-device keys for multiple machines
• Encrypted local backups with automatic rotation (keeps the last 5, expires after 30 days)
• File integrity checksums (detects tampering/corruption)
• Multi-pass secure delete of the original file after encryption
• Optional email alerts when vault actions happen
• Optional right-click "Encrypt/Decrypt with Secure Vault" entry in Windows Explorer
• Fully unattended installer — no interaction required beyond the initial double-click

---

Installation

1. Go to the Releases page and download the latest SecureVaultSetup-x.x.x.exe.
2. Run it.
   • Windows may show a "Windows protected your PC" SmartScreen warning. This is expected for a new, unsigned installer — click "More info" → "Run anyway". See Security notes for why this happens.
   • The installer requires administrator rights (it may install Node.js if it's missing, and can register a right-click shell extension).
3. During setup you'll be asked whether to create a desktop shortcut and whether to add the right-click menu integration — both optional, check the boxes you want.
4. The installer will:
   • Check for Node.js and install it silently if missing
   • Install the app to Program Files\SecureVault (or your chosen location)
   • Install the one required dependency (nodemailer, used only for the optional email feature)
   • Create Start Menu / Desktop shortcuts
5. Click Finish — Secure Vault launches automatically.

No manual steps, no command line required for a normal install.

---

First-time setup

The very first thing to do after installing is register a USB drive as your master key. Nothing can be encrypted or decrypted until this is done.

1. Plug in a USB flash drive you're comfortable dedicating to this purpose.
2. Launch Secure Vault (Start Menu or Desktop shortcut).
3. From the menu, choose Option 3 — Register USB.
4. Type: master
5. Enter the drive letter, e.g. E: (see Troubleshooting if this fails).
6. Secure Vault writes a .vault_master.key file to the root of that drive. Do not delete this file, and do not lose this drive.

Optional but recommended: copy that .vault_master.key file to a second, safely-stored USB drive as a backup, in case the primary one is ever lost or damaged.

---

Using Secure Vault

Launch the app via the Start Menu / Desktop shortcut to get the interactive menu:

========================================
  SECURE VAULT
========================================
  1. Encrypt a file
  2. Decrypt a file
  3. Register USB
  4. View devices
  5. View backups
  6. Restore file
  7. Configure email
  8. Install right-click menu
  9. Exit

1. Encrypt a file

Choose option 1, then enter the full path to the file or folder. Your registered USB drive must be plugged in. The output is a .vault file; the original is securely deleted (overwritten 3 times) after a successful encryption and backup.

2. Decrypt a file

Choose option 2, enter the path to the .vault file. Your registered USB drive must be plugged in — decryption is impossible without it.

3. Register USB key

Covered in First-time setup above. You can also register additional per-device keys (choose device instead of master) if you want a separate key for a second machine while keeping one master key overall.

4. View registered devices

Lists every USB key (master and device) currently registered, pulled from config/registered-devices.json.

5. Backups

Every time you encrypt a file, Secure Vault automatically saves an encrypted backup copy locally (rotated — keeps the 5 most recent, auto-expires after 30 days). Option 5 lets you list and view these.

6. Restore

Restores a file from one of those local backups, in case you need the pre-encryption version back without going through decrypt.

7. Email alerts

Optional. Sends you an email whenever a vault action happens (encrypt/decrypt), including which file, which computer, and when.

Setup requires a Gmail App Password — not your normal Gmail password. Steps:

1. Make sure 2-Step Verification is enabled on the Gmail account you want to send from — go to myaccount.google.com/security and turn it on if it isn't already. App Passwords are unavailable without this.
2. Go to myaccount.google.com/apppasswords, sign in, and generate a new App Password (name it anything, e.g. "Secure Vault"). Copy the 16-character code shown — it's only displayed once.
3. In Secure Vault, choose Option 7.
4. Answer the prompts:
   • Enable email alerts? (y/n) → y
   • Your Gmail address → the account you generated the App Password for
   • Gmail App Password → paste the 16-character code (not your real Gmail password)
   • Alert recipient email → where you want alerts sent (can be the same address)

Notes: