Vault Desk is a cutting-edge, zero-knowledge, end-to-end encrypted cloud storage solution designed to give users complete control over their data privacy. Unlike traditional cloud storage providers, Vault Desk ensures that all files and even filenames are encrypted directly on your device before they are uploaded to the server. This fundamental design principle means that the server only ever stores ciphertext and wrapped keys, rendering your data unreadable to anyone, including Vault Desk itself, even in the event of a server breach.
The platform is built with a "threat model first" approach, assuming that the server infrastructure could be compromised. This robust security posture is achieved through several advanced cryptographic techniques:
- End-to-End Encryption: Each file is meticulously encrypted client-side using the powerful XChaCha20-Poly1305 algorithm. This ensures that your sensitive information is transformed into unreadable ciphertext before it ever leaves your device, making it impossible for the server to access the plaintext.
- Passwordless-Safe Login (OPAQUE): Vault Desk implements the OPAQUE Asymmetric Password-Authenticated Key Exchange (aPAKE) protocol (RFC 9807). This innovative method allows you to authenticate without your password ever leaving your device, not even in a hashed form. The server can verify your identity without ever seeing or storing your actual password, significantly reducing the risk of credential theft.
- Secure Sharing: When you share a file, its decryption key is securely sealed to the recipient's public key. This ensures that only the intended recipient can access the file. You retain full control, with the ability to revoke access or modify sharing roles at any time.
- Public Links with Client-Side Decryption: For broader sharing, Vault Desk offers public links where the decryption key is embedded directly within the link (after the # symbol). Crucially, this key never reaches Vault Desk's servers, maintaining the zero-knowledge principle. Users can further enhance security by adding a password and an expiry date to these links.
- Key Transparency: To prevent malicious key substitution, recipients' public keys are published in a tamper-evident, append-only log. This mechanism allows clients to detect if the server attempts to swap in a key it controls, ensuring the integrity of key distribution.
- Account Recovery: In case you forget your password, a one-time recovery key provided at sign-up can restore access. This process also happens entirely on your device, re-wrapping your keys under a new password without Vault Desk ever gaining access to your decryption keys. It's vital to keep this recovery key safe, as it's your only backup.
- Open Crypto Core: The underlying cryptographic core is built on well-reviewed, standard primitives from libsodium (XChaCha20-Poly1305, X25519, Ed25519, Argon2id). This small, auditable core is shared across both web and mobile applications, ensuring consistent and verifiable encryption behavior across all platforms.
Vault Desk is available as a fast, modern web application built with Next.js and React, requiring no plugins or installations. It also offers dedicated mobile apps for iOS and Android, which share the identical crypto core for byte-for-byte consistent encryption. The service provides flexible pricing tiers, starting with a free plan offering 5 GB of encrypted storage, with options to upgrade for more space and advanced features like password-protected links and team collaboration. This makes Vault Desk an ideal privacy-first alternative to services like Google Drive and Dropbox for individuals and organizations prioritizing data security and privacy.
