NokVault
Install NokVault

Local encryption / deliberately private

Your files.
Your keys.
Your control.

Strong local encryption without surrendering your data, workflow, or judgment to a cloud service.

Install NokVault Read the docs
Quick start 
PS> nokvault encrypt .\archive
✓ Encryption completed successfully

PS> nokvault decrypt .\archive.nokv
✓ Decryption completed successfully
  • AES-256-GCM
  • ARGON2ID
  • LOCAL-FIRST
  • OPEN SOURCE

First successful workflow

Install, encrypt, and prove recovery

Three deliberate steps get a first-time operator from zero to a verified ciphertext without guessing at security decisions.

  1. Install

    Choose the package manager or release binary that matches your platform.

    Installation

  2. Encrypt

    Encrypt a file or directory with an interactive password or a protected keyfile.

    Basic Usage

  3. Verify recovery

    Decrypt the result before you discard the original. Credential recovery is not possible without your password or keyfile.

    Credential guidance

Workflow capabilities

Built for operators, not dashboards

Capabilities are organized by outcome: protect data, automate locally, reduce operator error, and integrate with tooling you already run.

  • Files and directory trees

    Encrypt individual files or recurse through directories while preserving structure for a clean decrypt path.

  • Trusted local automation

    Watch directories and schedule encrypt jobs on machines you already trust-no cloud sync or remote agent required.

  • Operator safeguards

    Overwrite refusal, confirmation gates, strict mode, and path-containment checks reduce irreversible mistakes.

  • JSON and NDJSON integration

    Stable machine-readable output supports scripts, DFIR tooling, and SOAR pipelines without scraping terminals.

Security posture

Mechanisms, safeguards, and honest boundaries

Trust the cryptography, use the operational guards, and read the limits before you rely on deletion or memory handling claims.

Security Overview Best Practices

Mechanisms

  • AES-256-GCM authenticated encryption
  • Argon2id password-based key derivation with per-file salts
  • Cryptographically secure IVs; authenticity via AES-GCM tag verification

Safeguards

  • Default-deny symlink and reparse-point path policy
  • Overwrite refusal, confirmation gates, and strict abort modes
  • Directory output containment before prompts or writes

Boundaries

  • Best-effort secure delete on SSD, COW, and snapshot storage
  • Best-effort memory zeroization against swap and memory dumps
  • Path-validation race against a privileged local attacker is a non-goal

Installation

Install on your platform

Every option stays in the page without JavaScript. With scripting available, the control group emphasizes one panel and keeps the URL hash in sync.

Homebrew

brew install jimididit/nokvault/nokvault

Scoop

scoop install https://raw.githubusercontent.com/jimididit/nokvault/main/scoop/nokvault.json

Release binary

gh release download v0.4.1 --repo jimididit/nokvault

Source

go install github.com/jimididit/nokvault/cmd/nokvault@v0.4.1
Start with Installation Inspect the source