Vault Desk

End-to-end encrypted file storage. Encrypted on your device; the server only ever sees ciphertext. A privacy-first alternative to Google Drive and Dropbox.

Your files, encrypted before they leave your device.

Vault Desk is an end-to-end encrypted drive. Everything is encrypted on your device — the server only ever stores ciphertext and wrapped keys. Not even we can read your files.

Upload, organize, share, and recover your files. Every operation happens over data that's already encrypted on your device.

Each file is encrypted client-side with XChaCha20-Poly1305 before it's uploaded. The server stores only ciphertext.

OPAQUE means your password never leaves your device — not even hashed. The server can authenticate you without ever seeing it.

Share a file and its key is sealed to the recipient's public key. Revoke access or change roles whenever you like.

Share with anyone. The decryption key lives in the link itself (after the #) and never reaches our servers. Add a password and an expiry.

Recipients' public keys are published in a tamper-evident, append-only log — so the server can't quietly swap in a key it controls.

Forget your password? A one-time recovery key restores access — without us ever holding the keys that decrypt your files.

Three steps, and at no point does the server hold anything it can decrypt.

Your password derives your keys locally. Files are encrypted in the browser before a single byte is uploaded.

The server receives encrypted blobs and wrap