How your files stay private
We built File Vault so that we can’t read your files — not your password, and not what’s inside your documents.
What this means for you
People sometimes call this zero-knowledge storage. In plain terms: even though we run the servers, we cannot open your files — even if we wanted to, and even if someone stole our disks.
Your password stays in your browser. We only receive proof that you know it, plus files that are already locked.
How it works, step by step
-
Sign up
Your browser creates a secret key for your files, locks it with your password, and shows you a backup key to save. We store the locked key — not your password.
-
Log in
You enter your password on your device. Your browser unlocks your files in that tab. Closing the tab locks them again for safety.
-
Upload
Each file is locked on your device first — including its title, description, tags, and filename. Only scrambled data reaches us.
-
View & download
Files download to your browser, unlock there, then preview (PDF, images, text) or save. We never handle the readable file content.
What we can and can’t see
| Data | On our servers | Can we read it? |
|---|---|---|
| Your password | Never sent | No |
| Key that opens your files | Locked with your password | No |
| File contents | Scrambled only | No |
| Title, filename, tags | Scrambled only | No |
| Email address | Plain (for login) | Yes |
| Storage used, file sizes | Plain numbers | Yes (not content) |
Your backup key — read this carefully
When you sign up, you get a backup key (shown once). It’s the only way back in if you forget your password.
We cannot reset your password or recover your files for you. That is intentional: if we could, someone could force us to open your data.
Lose both your password and backup key, and your files are gone permanently.
Technical details
- Password → master key: PBKDF2-SHA-256 with 310,000 iterations and a unique salt per account.
- Login verifier: HKDF-derived auth material, hashed on our side. Proves you know the password without sending it.
- Vault key: A random 256-bit key that encrypts all your files. Wrapped under your master key.
- Files & metadata: AES-256-GCM with a unique IV per blob. Tampering is detected on decrypt.
- Backup key: Your vault key, encoded for safekeeping. We store only a SHA-256 fingerprint to verify recovery — not the key itself.
What this does not protect against
- A hacked website: If someone changes this site’s code, they could steal keys from your browser while you use the app. Prefer HTTPS and a site you trust.
- A compromised device: Malware, keyloggers, or someone using your unlocked browser can see files after you open them.
- Account metadata: We may still see your email, upload times, storage totals, and IP addresses for running the service and stopping abuse.
- Office documents: Word, Excel, and similar files are stored locked but open via download — not previewed in the browser.
Ready to try it?
Create a free account, save your backup key offline, and upload your first private file.