VaultZip
Turns a folder into one password-locked file, with a fingerprint for every file inside.
Free right now — no account, no card
Preview
1 interface design, then a screenshot of it running. Drag, scroll or use the arrows.
Free while we’re in preview
Get VaultZip
Turns a folder into one password-locked file, with a fingerprint for every file inside.
The Mac button is for Apple Silicon. On an older Intel Mac, get this one instead.
One file, both ways. Double-click it for the window. Run the same file from a command prompt with arguments and it behaves as the command-line tool, because the engine is inside it. Nothing else to download and nothing to keep beside it.
Early preview. The window has been built and run, but not yet on a real Windows PC or Mac, so expect rough edges. The engine underneath it is fully tested.
- One file — no installer
- Runs on your machine, offline
- Source code published below
Free while in preview. It isn’t signed yet, so Windows or macOS will ask you to confirm the first time you open it. At launch, VaultZip is included in every plan along with the rest of the range.
Three commands
vaultzip pack ~/taxes -o taxes.vz `--password` PASS
vaultzip verify taxes.vz `--password` PASS
vaultzip unpack taxes.vz -o restored `--password` PASS
verify authenticates the vault and lists what’s inside with a SHA-256 for each file, without writing a single byte to disk. Use it to confirm an archive is still intact before you rely on it, or just to remind yourself what you put in there two years ago.
The format, and how far to trust it
A vault is tar, then gzip, then AES-256-GCM over the lot, with a random salt and nonce stored ahead of the ciphertext. Because GCM authenticates, a wrong password fails loudly instead of quietly handing you garbage, and so does an archive somebody altered by one byte.
The key is stretched from your password by 200,000 rounds of iterated SHA-256. Go’s standard library ships no KDF, and this is a dependency-free stand-in for PBKDF2. It has not been independently audited. Treat it as a working prototype of the mechanism rather than production-grade cryptography, and don’t put anything in it you’d lose sleep over.
The archive is assembled in memory, so this suits a documents folder better than a video library. The WinUI shell and archive preview are still roadmap.
Reading on the job itself
- How to password-protect a folder of files Make sure it is AES-256 and not the legacy ZipCrypto, use a long passphrase rather than a clever short one,...
Advanced & technical details Command-line builds, source code, checksums and a recorded session — for developers and IT teams
A working CLI prototype of the core engine: AES-256-GCM password-encrypted archives (tar+gzip inside) with authenticated verify/extract and per-file SHA-256 checksums. Previewing an archive's contents before extracting is still on the roadmap; the window is built and ships with the program.
Naming status
Working name only — brand verdict **AVOID** (Very High). Collision: VaultZip. Rename completely.
What it draws on
Existing paid software whose best ideas shaped this program: WinRAR, WinZip, Folder Lock, O&O SafeErase.
Command line
There is nothing extra to install. The program you download is the command-line tool as well: give it arguments instead of double-clicking it and it runs as one, with its output on your terminal. The standalone builds below are the same engine on its own, for machines where you would rather not ship a window at all.
VaultZip — password-encrypted archive with checksum verification
Usage:
vaultzip pack <path> [<path> ...] -o vault.vz --password PASS [--dry-run]
vaultzip unpack <vault.vz> -o outdir --password PASS
vaultzip verify <vault.vz> --password PASS
Flags:
-o <file> Vault to write (pack) or directory to extract into (unpack).
--password P Vault password. Required by every command.
--dry-run pack only. List every file that would go into the vault, with
its size on disk, and write nothing at all — no vault, no
partial file, no temporary. Warns if a vault already exists at
the -o path and would be replaced. Add it to the command you
were about to run to see what it would do first.
"verify" authenticates and lists contents without extracting anything.Recorded from the shipped binary, not written by hand.
Source
Every file the program is built from:
console.go · console_test.go · guided.go · main.go
SHA-256 checksums · build instructions & scope notes · full build plan