Vault Desk Puts File Privacy Before Convenience

A storage service is easy to trust when uploading a file feels like moving it from one folder to another. The harder question comes later: who can read that file while it sits on someone else's infrastructure? For tax records, identity documents, private photographs, or work files, the provider's ability to access the contents may be the problem, not the convenience of cloud storage.

Vault Desk is built around removing that access. It presents itself as a zero-knowledge file vault that encrypts files in the browser before they leave your device. The server is intended to receive ciphertext, encrypted filenames, and wrapped keys rather than readable files.

That makes Vault Desk less about adding another place to put files and more about changing who holds the ability to decrypt them.

What happens when you use it

The basic workflow is familiar. You sign in, upload files, organise them into folders, and access them through a web interface. The landing page shows areas for personal files, items shared with you, items shared by you, and deleted files. It also shows ordinary file operations such as creating a folder and uploading documents or images.

The important difference is where the cryptography is meant to happen. Vault Desk says files are encrypted locally with XChaCha20-Poly1305 before upload. Its description also says filenames are encrypted. The server therefore stores encrypted blobs and keys that have been wrapped so the service cannot use them directly.

The login design follows the same principle. Vault Desk says it uses OPAQUE, a password-authentication protocol, so your password is not sent to the server, not even as a password hash. The service can verify that you know it while the secret remains on your device.

These are meaningful design choices, but they also put more responsibility on the client. The browser is not just displaying a remote folder. It is handling encryption, decryption, and key management. A browser-based vault can protect data from a compromised storage database, but its security still depends on the software running in the browser and on the device where you use it.

Sharing without handing over the vault

Private storage is not useful if every collaboration requires downloading a file and sending it through another service. Vault Desk supports sharing in two different ways.

For another Vault Desk user, the file key is sealed to the recipient's public key. The service says you can revoke access and change roles later. It also describes a tamper-evident, append-only directory for public keys, intended to help clients detect a substituted key.

For someone outside the service, Vault Desk offers public links. In this model, the decryption key sits in the fragment of the URL after the #, rather than being sent to the server. The link can also have a password and an expiry, according to the product description.

That approach is convenient, but the link becomes sensitive. Anyone who obtains the complete link may have what they need to access the file, unless an additional password is required. Treating the URL like a secret is therefore part of using this feature safely. Public sharing is not the same as making a file public in the ordinary, searchable sense, but it does create a new object that must be protected.

Recovery is deliberately your responsibility

Vault Desk says account recovery uses a one-time recovery key. That key can restore access and allow your encryption keys to be wrapped under a new password, without the service holding the keys needed to decrypt your files.

This solves one problem and creates another. If you lose both your password and the recovery key, there is no provider-held decryption key waiting to rescue the account. That is the unavoidable cost of a system designed so the provider cannot read the contents. The recovery key needs to be stored somewhere safe and separate from the account.

The product claims to use a small crypto core based on libsodium, with XChaCha20-Poly1305, X25519, Ed25519, and Argon2id among the named components. Those names describe established building blocks, not a guarantee that the complete implementation is correct or that every surrounding part of the application is secure. The useful claim here is that Vault Desk has chosen to make its threat model explicit: a stolen server database should contain data that is still encrypted.

Who Vault Desk suits

Vault Desk has a free plan and a paid upgrade, with the same encryption approach across its plans. It runs on the web, so it fits people who want encrypted storage through a browser and are comfortable letting that browser perform the cryptographic work. It could suit someone saving sensitive personal files who wants ordinary upload, folder, and sharing tools without giving the storage operator readable copies.

The web-only platform is a clear constraint. There is no listed desktop or mobile application in the supplied platform information, so this is not a good fit for someone expecting native file-system integration, automatic phone photo backup, or a local sync folder. The recovery model is another hurdle for people who want a support team to restore access.

In short, Vault Desk is for people who value provider-blind storage and will take responsibility for passwords, recovery keys, and shared links. It is not for users who regard cloud storage as a background utility that should handle every device, backup, and account failure on their behalf.