What this is

Secure Vault encrypts individual files (or folders) on your Windows machine using AES-256-GCM. Instead of protecting the encryption key with just a password, the key is generated randomly and stored on a USB flash drive you choose. To decrypt anything later, that same USB drive has to be physically plugged in.

Why a USB key instead of a password

Passwords can be guessed, phished, keylogged, or brute-forced. A physical key can't be remotely stolen the way a password can. Trade-offs to understand before you rely on this:

• If someone steals your laptop but not your USB drive, they cannot decrypt your files.
• There is nothing to type, remember, or leak.
• There is no password reset. If you lose the USB drive and don't have a backup of the key file on it, anything encrypted with it is permanently unrecoverable. Treat that drive like a physical house key — know where it is at all times, and consider keeping a backup copy of the key file itself in a safe second location.

Features

• AES-256-GCM encryption with scrypt key derivation
• USB-based master key, plus optional per-device keys for multiple machines
• Encrypted local backups with automatic rotation (keeps the last 5, expires after 30 days)
• File integrity checksums (detects tampering/corruption)
• Multi-pass secure delete of the original file after encryption
• Optional email alerts when vault actions happen
• Optional right-click "Encrypt/Decrypt with Secure Vault" entry in Windows Explorer
• Fully unattended installer — no interaction required beyond the initial double-click

Installation

1. Go to the Releases page and download the latest SecureVaultSetup-x.x.x.exe.
2. Run it.
   • Windows may show a "Windows protected your PC" SmartScreen warning. This is expected for a new, unsigned installer — click "More info" → "Run anyway". See Security notes for why this happens.
   • The installer requires administrator rights (it may install Node.js if it's missing, and can register a right-click shell extension).
3. During setup you'll be asked whether to create a desktop shortcut and whether to add the right-click menu integration — both optional, check the boxes you want.
4. The installer will:
   • Check for Node.js and install it silently if missing
   • Install the app to Program Files\SecureVault (or your chosen location)
   • Install the one required dependency (nodemailer, used only for the optional email feature)
   • Create Start Menu / Desktop shortcuts
5. Click Finish — Secure Vault launches automatically.

No manual steps, no command line required for a normal install.

First-time setup

The very first thing to do after installing is register a USB drive as your master key. Nothing can be encrypted or decrypted until this is done.

1. Plug in a USB flash drive you're comfortable dedicating to this purpose.
2. Launch Secure Vault (Start Menu or Desktop shortcut).
3. From the menu, choose Option 3 — Register USB.
4. Type: master
5. Enter the drive letter, e.g. E: (see Troubleshooting if this fails).
6. Secure Vault writes a .vault_master.key file to the root of that drive. Do not delete this file, and do not lose this drive.

Optional but recommended: copy that .vault_master.key file to a second, safely-stored USB drive as a backup, in case the primary one is ever lost or damaged.

Using Secure Vault

Launch the app via the Start Menu / Desktop shortcut to get the interactive menu:

1. Encrypt a file

Choose option 1, then enter the full path to the file or folder. Your registered USB drive must be plugged in. The output is a .vault file; the original is securely deleted (overwritten 3 times) after a successful encryption and backup.

2. Decrypt a file

Choose option 2, enter the path to the .vault file. Your registered USB drive must be plugged in — decryption is impossible without it.

3. Register USB key

Covered in First-time setup above. You can also register additional per-device keys (choose device instead of master) if you want a separate key for a second machine while keeping one master key overall.

4. View registered devices

Lists every USB key (master and device) currently registered, pulled from config/registered-devices.json.

5. Backups

Every time you encrypt a file, Secure Vault automatically saves an encrypted backup copy locally (rotated — keeps the 5 most recent, auto-expires after 30 days). Option 5 lets you list and view these.

6. Restore

Restores a file from one of those local backups, in case you need the pre-encryption version back without going through decrypt.

7. Email alerts

Optional. Sends you an email whenever a vault action happens (encrypt/decrypt), including which file, which computer, and when.

Setup requires a Gmail App Password — not your normal Gmail password. Steps:

1. Make sure 2-Step Verification is enabled on the Gmail account you want to send from — go to myaccount.google.com/security and turn it on if it isn't already. App Passwords are unavailable without this.
2. Go to myaccount.google.com/apppasswords, sign in, and generate a new App Password (name it anything, e.g. "Secure Vault"). Copy the 16-character code shown — it's only displayed once.
3. In Secure Vault, choose Option 7.
4. Answer the prompts:
   • Enable email alerts? (y/n) → y
   • Your Gmail address → the account you generated the App Password for
   • Gmail App Password → paste the 16-character code (not your real Gmail password)
   • Alert recipient email → where you want alerts sent (can be the same address)

Notes:

• This feature is Gmail-only as currently built (hardcoded to smtp.gmail.com).
• The App Password is stored in plaintext in config/settings.json on your machine — don't share that file, and don't commit it with real credentials to a public repository.
• If sending fails (bad password, no internet), it logs an error and continues — it will never block or break an encrypt/decrypt operation.
• Fully optional — answering n skips it, and everything else works identically.

8. Right-click integration

Adds "Encrypt with Secure Vault" / "Decrypt with Secure Vault" to the Windows Explorer right-click menu, so you can encrypt/decrypt without opening the app menu first.

Command-line usage

Everything is also available without the interactive menu:

Run this from the install folder (e.g. C:\Program Files\SecureVault).

Configuration files

These are created with safe placeholder values on install and update automatically as you use the app — no manual editing required.

Building the installer from source

Requires Inno Setup 6 if building locally on Windows:

Output: dist/SecureVaultSetup-<version>.exe

Or let GitHub Actions build it for you (no Windows machine needed) — push a version tag:

The workflow in .github/workflows/build.yml builds the installer on a Windows runner and automatically attaches it to a GitHub Release.

Security notes

• The USB key is never stored in plaintext. As of v3.3.0, the 32-byte key on your USB drive is itself encrypted (AES-256-GCM) with a key derived from your password via scrypt. Someone with brief physical access to the USB drive alone cannot extract a usable key without also knowing the password — this replaces the earlier design, which stored the raw key in plaintext on the drive.
• This is removable-key possession, not hardware-bound custody. The key file on the USB drive is an ordinary, copyable file — not a secret stored inside tamper-resistant hardware like a smart card, TPM, or a device such as a YubiKey, which never lets raw key material leave the device at all. Someone with brief physical access to your drive (or malware running on your machine while it's mounted) can copy that file; it just isn't useful to them without your password too. If you need true hardware-bound custody, a dedicated hardware security token is a stronger choice than a commodity USB drive.
• Uses Node's built-in crypto module: AES-256-GCM with scrypt key derivation, random salts and IVs per operation, and authentication tags to detect tampering.
• Every encryption operation binds format/purpose context as AAD (Additional Authenticated Data) to its GCM authentication tag, so a ciphertext and tag from one context (e.g. the wrapped file-key layer) can never be silently swapped into a different context (e.g. the file-content layer).
• Encryption and integrity-check keys are derived separately (via HKDF) from the same root key, rather than reusing one key directly for two different cryptographic purposes.
• File integrity is checked with a keyed HMAC-SHA256 (using the same unlocked key), verified before decryption is attempted. Earlier versions used an unkeyed SHA-256 checksum, which anyone could forge — it added no real tamper protection. The current HMAC does.
• 7-Zip is invoked via execFileSync with arguments passed as an array, not a shell string — this closes a command-injection risk present in earlier versions, where a maliciously crafted file/folder name could have broken out of shell quoting.
• Passwords and key material are captured into Buffers (not JS strings) and explicitly zeroed (.fill(0)) as soon as each use is finished — as of v3.5.0, this now also includes the decrypted plaintext file content itself, not just key material. This is a real improvement but not an absolute guarantee — Node.js/V8 may retain other copies internally (e.g. during garbage collection, or if memory was paged to disk by the OS) that application code cannot reach or control.
• This project has not undergone an independent third-party security audit. It's built on standard, well-reviewed cryptographic primitives, and several issues raised by community review have been fixed (see CHANGELOG.md), but the implementation has only been reviewed informally overall. Use it for what you'd be comfortable losing, not as your only line of defense for anything irreplaceable.
• Secure delete overwrites the original file 3 times before removing it — note that on SSDs, wear-leveling means overwrite-based deletion doesn't guarantee the original data is unrecoverable at the hardware level.
• The installer is currently unsigned, which is why Windows shows a SmartScreen warning on first run. Unsigned doesn't mean unsafe — it means Windows hasn't yet built reputation for this specific publisher/file. You can verify the source code yourself in this repository before trusting the compiled .exe.
• There is no password recovery, by design. Your password is never stored anywhere. If you forget it, files encrypted with it are permanently unrecoverable, even with the correct USB drive in hand.

Troubleshooting

"Enter drive" — what format should I use? Any of E, e, E:, or E:\ work — Secure Vault normalizes it automatically and verifies the drive exists before writing anything.

ENOENT error mentioning a folder like e\.vault_master.key inside your install directory This was a bug in older versions where a drive letter typed without a colon (e.g. just e) was misread as a relative folder name instead of a real drive. Fixed as of this version — update to the latest release if you still see this.

Email alerts aren't sending

• Confirm 2-Step Verification is on for the Gmail account.
• Confirm you used an App Password, not your regular Gmail password.
• Check your internet connection.
• The error message printed to the console will usually state the specific cause.

SmartScreen blocks the installer Click "More info," then "Run anyway." This is expected for an unsigned installer — see Security notes.

Node.js / 7-Zip install seems to hang Check for a Windows UAC ("Do you want to allow this app to make changes?") prompt, possibly hidden behind other windows — the silent installers still require this one confirmation click.

License

MIT — see LICENSE.