ArchiveGuard
Shreds your originals only after proving the encrypted copy reads back byte for byte.
Free right now — no account, no card
Preview
1 interface design, then a screenshot of it running. Drag, scroll or use the arrows.
Free while we’re in preview
Get ArchiveGuard
Shreds your originals only after proving the encrypted copy reads back byte for byte.
The Mac button is for Apple Silicon. On an older Intel Mac, get this one instead.
One file, both ways. Double-click it for the window. Run the same file from a command prompt with arguments and it behaves as the command-line tool, because the engine is inside it. Nothing else to download and nothing to keep beside it.
Early preview. The window has been built and run, but not yet on a real Windows PC or Mac, so expect rough edges. The engine underneath it is fully tested.
- One file — no installer
- Runs on your machine, offline
- Source code published below
Free while in preview. It isn’t signed yet, so Windows or macOS will ask you to confirm the first time you open it. At launch, ArchiveGuard is included in every plan along with the rest of the range.
The order of operations is the feature
archiveguard seal ./photos -o cold.vz --password ... --apply packs the source into an AES-256-GCM vault, then immediately decrypts that vault into a temp directory and SHA-256 compares every extracted file against the original it came from. Only if all of that passes does it overwrite the originals with random data, fsync, and remove them.
Fail the comparison and it aborts loudly, wipes the temp directory, and touches nothing. A truncated vault can’t cost you your only copy.
Leave off --apply and the vault is still written for real and still genuinely verified. The shred step is the only thing gated. Nothing is faked in a dry run.
Reading it back
open extracts a vault, and a wrong password fails through GCM authentication with a clear error rather than silent garbage. verify authenticates the vault and lists names, sizes and hashes without extracting anything permanent.
One thing you should know
Key derivation is 200,000 rounds of iterated SHA-256 over password plus salt. It’s a dependency-free stand-in for PBKDF2 and it hasn’t been independently audited. For secrets that really matter, use an audited KDF.
Reading on the job itself
- How to password-protect a folder of files Make sure it is AES-256 and not the legacy ZipCrypto, use a long passphrase rather than a clever short one,...
Advanced & technical details Command-line builds, source code, checksums and a recorded session — for developers and IT teams
A working CLI prototype of the seal-verify-shred workflow: pack files into an AES-256-GCM encrypted vault (same wire format as the sibling VaultZip), verify a byte-identical round-trip before touching anything, and only then securely shred the originals — a corrupted or tampered vault aborts with zero data loss. Cloud vault sync is still on the roadmap.
Naming status
Working name only — brand verdict **CAUTION** (Medium). Collision: ArchiveGuard / ArchiveGuard Pro references. Only keep after formal clearance; consider coined alternative.
What it draws on
Existing paid software whose best ideas shaped this program: WinRAR, WinZip, Folder Lock, O&O SafeErase.
Command line
There is nothing extra to install. The program you download is the command-line tool as well: give it arguments instead of double-clicking it and it runs as one, with its output on your terminal. The standalone builds below are the same engine on its own, for machines where you would rather not ship a window at all.
archiveguard - archive, verify, and safely shred (Pro tier: seal->verify->shred)
Usage:
archiveguard seal <path> [<path> ...] -o <vault.vz> --password <PASS> [--apply]
archiveguard open <vault.vz> -o <outdir> --password <PASS>
archiveguard verify <vault.vz> --password <PASS>
archiveguard help
Commands:
seal Pack path(s) into an encrypted vault, verify the vault round-trips
byte-identically against the originals, and (only with --apply)
securely erase the original source files. Without --apply, the
vault is still created and still genuinely verified, but the
originals are left untouched (dry run of the shred step only).
open Decrypt and extract a vault to an output directory.
verify Authenticate a vault and list its contents with per-file SHA-256,
without extracting anything to a permanent location.
Flags:
-o, --output <path> seal: vault file to write. open: directory to extract into.
--password <pass> password for encryption/decryption (required)
--apply seal: actually shred originals after verified success
Vault format matches the sibling VaultZip tool: magic "VLTZ1\n" + 16-byte
salt + 12-byte GCM nonce + AES-256-GCM ciphertext of gzip(tar(files)).Recorded from the shipped binary, not written by hand.
Source
Every file the program is built from:
console.go · console_test.go · guided.go · main.go
SHA-256 checksums · build instructions & scope notes · full build plan