Vault Desk

Vault Desk is an end-to-end encrypted cloud drive that encrypts every file on your device before it leaves, storing only ciphertext and wrapped keys on its servers.

What is Vault Desk?

Vault Desk is an end-to-end encrypted drive that performs all encryption and decryption locally on the user's device. It accepts any file type and produces encrypted blobs with encrypted filenames for storage. The service runs as a web app built with Next.js and React, plus mobile apps for iOS and Android that share the same crypto core. It is developed by the Vault Desk team and uses libsodium primitives: XChaCha20-Poly1305 for file encryption, OPAQUE (RFC 9807) for passwordless-safe login, X25519 for sealed sharing, Ed25519 for signatures, and Argon2id for key derivation. The design ensures that not even Vault Desk can read your files. You can try it for free at vaultdesk.io.

Key Features

• End-to-end encryption — Each file is encrypted on your device with XChaCha20-Poly1305 before upload; the server sees only ciphertext.
• OPAQUE login — The server uses OPAQUE (RFC 9807) to authenticate you without ever seeing your password, even hashed.
• Secure sharing — Share a file by sealing its key to the recipient's public key; revoke access or change roles at any time.
• Public links — Create shareable links where the decryption key is embedded after the '#'; optionally add a password and an expiry date.
• Key Transparency — Recipients' public keys are recorded in a tamper-evident, append-only log so the server cannot substitute its own key.
• Account recovery — A one-time recovery key restored at sign-up lets you recover access without the server holding your decryption keys.
• Cross-platform crypto core — Web and mobile apps share a single, small libsodium-based crypto core that is deliberately easy to audit.

Who is it for?

• Individuals with sensitive documents — Store tax records, passports, and contracts knowing the server cannot read them.
• Privacy-focused teams — Use team spaces with shared encrypted storage, admin controls, and audit logs on the Team plan.
• Security-conscious users — Verify client behavior through Key Transparency and the auditable open crypto core.

What can you do with Vault Desk?

• Protect personal files — Encrypt passports, tax documents, and photos before syncing them to the cloud.
• Collaborate securely — Share project files with colleagues, control roles, and revoke access when someone leaves the team.
• One-time secure sharing — Generate public links with password and expiry to send sensitive data to external partners.

How does Vault Desk work?

Three steps ensure zero-knowledge: (1) Encrypt on your device — your password derives keys locally and files are encrypted in the browser before upload. (2) Upload only ciphertext — the server receives encrypted blobs and wrapped keys; filenames are encrypted too. (3) Only you hold the keys — sign in from any device to unwrap keys and decrypt locally.

Pricing

Vault Desk is freemium. Free: 5 GB encrypted storage, sharing and public links. Plus: $4 per month, 250 GB, password-protected links with expiry, priority support. Team: $15 per month, 1 TB, shared team spaces, admin controls and audit logs.

FAQ

Is Vault Desk truly zero-knowledge?

Yes. Zero-knowledge means Vault Desk has zero knowledge of your file contents. Encryption and decryption happen entirely on your device; the server only stores ciphertext and keys that are themselves encrypted (wrapped), so no operator can read your files.

What happens if I forget my password?

At sign-up you receive a one-time recovery key that independently unlocks your account and allows you to re-wrap your keys under a new password. Since the server never holds your keys, the recovery key is the only backup — keep it safe.

Can Vault Desk (or a hacker) read my files?

No. The threat model assumes the server can be compromised. An attacker with the full database sees only encrypted blobs and wrapped keys, which are unusable without your password — and your password is never transmitted.

Is the encryption open to inspection?

Yes. Vault Desk uses standard primitives from libsodium — XChaCha20-Poly1305, X25519, Ed25519, Argon2id — in a single, small crypto core shared across web and mobile, deliberately designed for auditing.

Where are my files stored?

Encrypted blobs live in object storage; encrypted metadata and wrapped keys live in the database. Vault Desk also offers self-hosting of the entire stack, though the data remains meaningless without the keys only you hold.