Security Architecture

For the technically curious: here is exactly how FileLocker encrypts your data locally using modern Web Crypto APIs.

1. Key Derivation (Argon2id)

When you enter a password, FileLocker does not use it directly as an encryption key. Instead, we use Argon2id (the winner of the Password Hashing Competition) to derive a secure 256-bit cryptographic key.

We generate a unique, cryptographically secure 16-byte salt for every file. This salt is stored in the header of the resulting .vault file, ensuring that even if you use the same password for two different files, the resulting encryption keys are entirely different.

2. Data Encryption (AES-GCM)

The actual file contents are encrypted using AES-GCM (Advanced Encryption Standard with Galois/Counter Mode). AES-GCM is a widely used authenticated-encryption mode that provides confidentiality and integrity protection when implemented correctly.

  • AES-256 provides a large key space designed to make exhaustive brute-force attacks impractical when strong passwords and secure key derivation are used.
  • GCM (Authenticated Mode) ensures that if a single byte of the encrypted .vault file is tampered with or corrupted, FileLocker will detect it and refuse to decrypt the file, preventing malicious alterations.

3. Large File Streaming

Browser applications that load an entire large file into memory can encounter resource limits. FileLocker uses browser storage and streaming APIs to reduce the need to hold the entire file in memory.

The current tool reads and encrypts data in smaller chunks, then writes the protected file through the browser's File System Access API. This reduces the need to hold the entire source file in memory at once. Actual file-size limits depend on browser support, available storage, device resources, and the file being processed.

4. Folder Packaging (TAR)

When you choose to protect an entire folder, FileLocker intercepts the folder structure and creates a raw byte-stream TAR (Tape Archive) on the fly. This TAR stream is fed directly into the AES-GCM encryption pipeline.

When you unlock a protected folder, FileLocker reverses the packaging process to restore the folder structure. The resulting files depend on successful decryption and the integrity of the protected data.