A new look built around a seal for every file, a new icon, and a round of fixes to how files are chosen, encrypted and opened. The .vault format is unchanged.
Added
- A seal for every file. Each
.vaultfile has its own fine-line seal and seal number, drawn from the random salt in its header. The seal is drawn while the file encrypts, shown again when you open the file, and breaks when it is decrypted. A wrong password shakes it. - Decrypt several
.vaultfiles in one go with one password. - Edit the selection before encrypting: drop more files to add them, or remove files one by one from the list.
- Download again on the result screen, when the browser kept the result in memory.
- VAULT asks whether you have saved a generated passphrase before it encrypts with it. Copying the passphrase counts.
- Home-screen icons, a web manifest and a link preview image.
- Every release now carries a
SHA256SUMSfile, one line per file the site serves. SECURITY.md explains how to check a deployment against it.
Changed
- New interface. On a computer the work is on the left, and the file's seal with four facts (seal number, cipher, key, uploads) is on the right. Phones get one column. Progress is a large percentage over a thin line.
- One colour. A single green replaces the blue and green pair, and a word above the file names the state (Encrypt, Encrypting, Encrypted, Decrypt, Decrypting, Decrypted), so the state never depends on colour alone.
- New icon: one strand of the seal, woven into a ring.
- New typefaces: Archivo and JetBrains Mono, served from the same origin as the page. Nothing is loaded from a third party.
- The Encrypt/Decrypt switch is gone. VAULT chooses from what you drop, and a link lets you encrypt a
.vaultfile again instead. - The result screen says where the file went as the browser reports it: saved where you chose, or sent to the browser's downloads.
- A generated passphrase is rated by its real strength (about 77 bits). The estimator sometimes rated one lower, because a few of its words are also common passwords.
- Long file names lose their middle, never their extension.
- The page keeps its height while you type, so buttons don't move under your finger.
- The video in the README is remade in the new design. It shows the app itself.
Security
- The
?sink=option, which forces how the result is saved, now works only on local addresses. Before, a link to a real deployment could force the whole output into memory. - Argon2 comes from hash-wasm 4.13.0 (was 4.12.0).
- The example Docker Compose file uses Caddy 2.11.9.
Compatibility
- No format changes. Files from 2.0 and 1.x open as before.
- Nothing changes in how the Docker image is run.
- The first load is larger: about 248 KB before compression, up from 114 KB. Most of the difference is the text typeface.