Frequently Asked Questions

General

What is NokVault?

NokVault is a local-first CLI for encrypting files and folders. It uses AES-256-GCM with Argon2id key derivation and keeps all cryptographic work on your machine.

Is NokVault free to use?

Yes. NokVault is open source under the MIT License for personal and commercial use. See the License page.

What platforms does NokVault support?

NokVault supports Windows, Linux, and macOS. Pre-built binaries are available on the GitHub Releases page.

Security

How secure is NokVault?

NokVault uses industry-standard primitives with explicit operational boundaries:

• AES-256-GCM for confidentiality and integrity to holders of the correct secret
• Argon2id key derivation with per-file salts (format-v2 parameters stored in the header)
• Cryptographically secure salts and nonces generated by current encryption code
• Best-effort memory zeroization (swap, crash dumps, and copies remain limitations)
• Default-deny symlink and path-containment policy visible at validation time

Read the Security Overview for limitations, including secure-delete storage caveats.

Can encrypted files be recovered if I lose my password?

No. NokVault does not store passwords or provide password recovery. If you lose your password or keyfile, encrypted data cannot be recovered. Keep secure backups of keyfiles.

Is my data sent to any servers?

No. NokVault works entirely locally. Encryption and decryption run on your machine; the tool does not transmit your files over the network.

Usage

Can I encrypt entire directories?

Yes. Provide a directory path for recursive encryption:

nokvault encrypt ./documents

What happens to the original files after encryption?

By default, originals remain unchanged and encrypted copies use a .nokv extension (legacy .nokvault files still decrypt). Delete originals only after you verify recovery.

Can I use NokVault in scripts and automation?

Yes. Use --no-prompt with a keyfile or NOKVAULT_PASSWORD:

export NOKVAULT_PASSWORD="your-password"
nokvault encrypt file.txt --no-prompt

Why was my path rejected with SYMLINK_DISALLOWED or PATH_ESCAPE?

NokVault does not follow symbolic links, Windows junctions, or other detected reparse points, and directory outputs must stay inside the selected root. Nested links are rejected by commands that recurse. There is no follow opt-in. Point the command at a regular file or directory, or choose an output that does not escape the destination. These checks run before --dry-run and before password prompts. They do not claim to stop a privileged local attacker who replaces a path after validation.

How do I decrypt multiple files at once?

Decrypt a directory, or loop over files:

# Decrypt entire directory
nokvault decrypt ./encrypted-documents

# Or use a loop
for file in *.nokv; do
  nokvault decrypt "$file" --keyfile ~/.keys/master.key --no-prompt
done

Troubleshooting

I'm getting "authentication failed" errors

This usually means:

• Incorrect password or keyfile
• Wrong keyfile path
• File encrypted with a different key
• File corruption or tampering

Use the same credentials that produced the ciphertext, and verify the file was not truncated.

The binary won't run on my system

Download the binary that matches your OS and architecture. On Linux/macOS, make it executable:

chmod +x nokvault

Encryption is very slow

Large trees take time. You can:

• Use --verbose to see progress
• Consider --compress for compressible text workloads

Can I use NokVault files across different operating systems?

Yes. Encrypted files are platform-independent. A file encrypted on Windows can be decrypted on Linux or macOS, and vice versa.

Still have questions?

If you cannot find the answer:

• Check the Commands documentation
• Review the Security documentation
• Open an issue on GitHub
• Start a discussion on GitHub Discussions