Vault X
ShippedA private, offline file vault for Windows. Your files, encrypted on your own disk, with a PIN nobody printed on the door.
- Channel
- Microsoft Store
- Crypto
- AES-256-GCM · Argon2id
- Stack
- WinUI 3 · C# · .NET 8
- Year
- 2026
Problem
Every file vault asks you to trust a server you cannot inspect. For anyone handling private documents, or client data, that trade simply is not available.
Solution
Vault X keeps everything on the machine. Files are encrypted before they touch disk, there is no account to create, and there is no server to breach. A decoy PIN opens a different vault entirely, for the situation where someone is standing over your shoulder.
Architecture
The PIN is never the key. A random 256-bit data key encrypts the vault, and that key is wrapped separately under your PIN, your recovery phrase, and optionally Windows Hello, so only wrapped values ever hit disk. Sub-keys are derived for the database and the file blobs. The decoy vault is escrowed under the real key, and unlock tries the real PIN and the decoy in equal time, so there is no timing tell.
Outcome
Published on the Microsoft Store, free, and installable in one click. 97 tests passing. Getting there meant MSIX packaging, certification, and writing the justification for the restricted file-system capability the app needs to lock a file in place. Nobody writes about that part, and it is most of the work.