What the File Safe does
Email attachments, USB sticks and cloud folders are all places where a file can end up in the wrong hands. The File Safe turns a file into an encrypted .vault file that is unreadable without the password. You can store or send the .vault file anywhere. Only someone with Vault Studio Pro and the password can turn it back into the original file.
How to encrypt a file
- Open the app and open the Vault, then the File Safe panel.
- Choose any file from your computer.
- Enter a strong password. The strength meter helps you avoid weak ones.
- Save the resulting .vault file. It gets a neutral default name — not the original file name.
To decrypt, open the .vault file in the File Safe and enter the password. You get the original file back with its name and type, decrypted along with the rest of the file.
The cryptography, precisely
- Key derivation: your password is stretched into a 256-bit key with PBKDF2 using SHA-256, 600,000 iterations (OWASP's current recommendation) and a random 16-byte salt for every file. The salt means the same password gives a different key each time.
- Encryption: AES-GCM with that 256-bit key and a random 12-byte nonce. GCM is authenticated encryption, so a .vault file that has been altered or corrupted fails to decrypt instead of giving you damaged data.
- Implementation: the browser's own Web Crypto API does the maths. We don't use a home-made cipher.
- Format: a .vault file is a small JSON wrapper holding the encrypted data and a timestamp. The original file name, type and size are encrypted along with the file's contents, not stored in plain text — they're restored automatically once the correct password decrypts them.
What it protects, and what it doesn't
- Your password is the only key. We never see it and can't reset it. If you forget it, the file can't be recovered.
- Password strength matters more than the cipher. A short or reused password can be guessed offline by someone who has the .vault file. Use a long passphrase or a password manager.
- It protects the file, not your computer. Malware on your device, or someone using your unlocked computer, can see files before they're encrypted or after they're decrypted.
- It's not a standard PDF or Office password. Other programs can't open a .vault file. The recipient needs Vault Studio Pro, which is free for decrypting.
Encrypted project exports and backups
The same encryption is used when you export a Docs, Sheets or Slides project as an encrypted .vault. Two things are not encrypted: projects stored inside the app (they live in your browser's storage on this device) and the full-backup .vaultbackup file, which is plain JSON. Encrypt a backup with the File Safe before you store it somewhere shared.
Sharing an encrypted file
Send the .vault file however you like, and share the password another way, for example by phone or a different messaging app. The PDF editor's "Protect" tool uses the same .vault format for PDFs.
Common questions
Can I encrypt a whole folder?
Compress the folder into a .zip file with your operating system first, then put the .zip in the File Safe.
Is there a size limit?
The file is encrypted in your browser's memory, so the practical limit depends on your device. Everyday documents, spreadsheets, PDFs and photos are fine. Very large files, such as long videos, may be too big for the browser.