Offline Encrypted Container Manager — seal your files into portable, password-protected containers on your own device. AES-256-GCM + Argon2id, 100% offline, zero telemetry.
🌐 cryptainer.forked.online · ⬇️ Download · 📖 Docs
Cryptainer is free and open source. Grab a build, or compile from source.
| Platform | Download | Notes |
|---|---|---|
| 🐧 Linux | AppImage · .deb | AppImage runs on any distro — no install |
| 🤖 Android | APK | universal, signed release |
| 🪟 Windows | coming soon | build from source |
| 🍎 macOS | coming soon | build from source |
| 📱 iOS | coming soon | build from source |
All releases & checksums → github.com/mrvigneshvt/Cryptainer/releases
One Rust + Tauri core runs everywhere, so a .ctnr sealed on one platform opens, byte-for-byte, on another.
- 🔐 Military-Grade Encryption: AES-256-GCM authenticated encryption with Argon2id key derivation
- 📦 Encrypted Containers: Store multiple files in a single encrypted container
- 🔓 Password Protection: Unlock containers with your password — no keys stored on disk
- ⚡ Lazy Decryption: Open a container instantly — files decrypt on-demand when you preview them
- ✏️ Edit Mode: Add or remove files from existing containers with automatic re-encryption
- 💾 Portable Format: Export/import containers using the
.ctnrfile format - 🗄️ Local Storage: All data stored locally — no cloud, no servers, 100% offline
- Memory-Safe Key Handling: AES keys are wrapped in
Zeroizing<>and wiped from memory immediately when containers are locked - LRU Cache with Zeroization: Decrypted file data is cached (50 MB) and zeroized on eviction or explicit release
- Session Management: Unlocked containers held in memory only, cleared on lock/app close
- Integrity Protection: SHA-256 checksums + GCM authentication tags detect tampering or corruption
- V1 → V2 Auto-Migration: Legacy containers are automatically migrated to the v2 per-file encryption format on unlock
- Configurable Security Levels: Choose from Fast, Standard, High, or Paranoid Argon2id settings
- Auto-Lock: Automatically lock containers after configurable period of inactivity (default 5 minutes)
- Images: PNG, JPG, GIF, WebP (with preview)
- Videos: MP4, WebM (with playback)
- Audio: MP3, WAV, OGG (with playback)
- Documents: PDF (with embedded viewer)
- Code Files: 20+ languages with syntax highlighting (Rust, TypeScript, Python, etc.)
- Text Files: UTF-8 text with line numbers
- Binary Files: Hex dump view with offset/hex/ASCII display
- 🔍 Search & Filter: Search containers by name or tags
- 🏷️ Tag System: Organize containers with custom tags, filter by tag
- 📊 Sort Options: Sort by name, date, size, or file count
- ⚙️ Settings: Configure auto-lock timeout
- 🔑 Password Hints: Optional hints to help remember passwords
- 💪 Password Strength: Visual indicator for password strength
- 🎨 Themes: PRISM (light, frosted glass) and CIPHER (dark, terminal) — two complete design systems
- Rust — Systems programming with memory safety (edition 2021)
- Tauri v2 — Secure cross-platform app framework (desktop + mobile)
- AES-256-GCM — Authenticated encryption (via
aes-gcmv0.10) - Argon2id — Memory-hard password hashing (via
argon2v0.5) - SQLite — Local metadata storage (via
sqlxv0.7) - LRU Cache — Bounded in-memory cache with zeroization (via
lruv0.12) - Zeroize — Automatic secure memory wiping (via
zeroizev1.7)
- React 18 — UI framework
- TypeScript — Type-safe JavaScript
- Vite — Fast build tooling
- Zustand — Lightweight state management
- Prism.js — Syntax highlighting (via
prism-react-renderer) - react-dropzone — Drag-and-drop file selection
# Clone the repository
git clone https://github.com/mrvigneshvt/Cryptainer.git
cd cryptainer
# Install dependencies
npm install
# Run in development mode
npm run tauri dev
# Build a release bundle (.AppImage, .deb, .dmg, .msi …)
npm run tauri build# One-time: initialise the Android project (needs Android SDK + NDK)
npm run tauri android init
# Build a signed release APK / AAB
npm run tauri android buildSee docs/SETUP.md for detailed setup instructions and platform-specific dependencies.
- Click "+ New Container"
- Select files to encrypt (drag-and-drop or file picker)
- Choose security level (Standard recommended)
- Set a strong password (min 8 characters)
- Optional: Add password hint and tags
- Click "Create & Encrypt"
- Click on a container card in the vault grid
- Enter your password
- Browse files — click any file to preview it
- Files decrypt on-demand; previews stream for videos/audio
- Open an unlocked container
- Click "Edit"
- Remove files or add new ones
- Enter password to verify and save changes
- Container is automatically re-encrypted with fresh nonces
- Export: Click the ↓ button on a container card → save
.ctnrfile - Import: Click "Import .ctnr" → select one or more files → containers appear in vault
┌─────────────────────┐
│ React App │ UI components, Zustand store, previews, auto-lock
│ (TypeScript) │
├─────────────────────┤
│ Tauri IPC Layer │ 10 type-safe invoke() commands
├─────────────────────┤
│ Rust Backend │ AES-256-GCM, Argon2id, SQLite, LRU cache
│ (src-tauri/src/) │
│ │
│ ┌───────────────┐ │
│ │ crypto.rs │ │ Encrypt/decrypt, key derivation
│ └───────────────┘ │
│ ┌───────────────┐ │
│ │ storage.rs │ │ SQLite CRUD (sqlx)
│ └───────────────┘ │
│ ┌───────────────┐ │
│ │ session.rs │ │ Session store + LRU cache with zeroization
│ └───────────────┘ │
│ ┌───────────────┐ │
│ │ export.rs │ │ .ctnr file format
│ └───────────────┘ │
│ ┌───────────────┐ │
│ │ commands.rs │ │ 10 IPC command handlers
│ └───────────────┘ │
└─────────────────────┘
│
▼
┌─────────────────────┐
│ File System + DB │ .enc blobs on disk + SQLite metadata DB
└─────────────────────┘
See docs/ARCHITECTURE.md for the complete module graph, component tree, and data flow.
Cryptainer uses two container formats:
| Format | Description | Status |
|---|---|---|
| v1 (legacy) | Single-blob encryption — entire payload encrypted as one AES-256-GCM output | Migrated to v2 on unlock |
| v2 (current) | Per-file encryption — metadata encrypted separately, each file encrypted individually, lazy decryption, LRU cache | Active |
See docs/CRYPTO.md for the full cryptographic specification and blob layout.
- ✅ File contents (AES-256-GCM authenticated encryption)
- ✅ File names and metadata (inside encrypted metadata section)
- ✅ Container structure and organization
- ✅ Integrity (SHA-256 checksums + GCM authentication tags)
- Container name (shown in UI for identification)
- Creation/modification dates
- File count and total size
- Password hint (intentionally visible for user convenience)
- Algorithm and KDF parameters
- Protects against: Unauthorized access, offline attacks, database theft, blob tampering
- Does NOT protect against: Compelled disclosure (password required), memory attacks on unlocked containers, keyloggers/malware on the host system
# Rust unit tests
cargo test
# TypeScript type checking
npx tsc --noEmit
# Rust linting
cargo clippy -- -D warningsSee docs/SETUP.md for full development workflow and docs/CHANGELOG.md for release history.
cryptainer/
├── astro-landing/ # Marketing site → cryptainer.forked.online
├── docs/ # Documentation
├── src/ # React frontend
├── src-tauri/ # Rust backend
│ ├── src/ # Rust source modules
│ ├── tests/ # Integration tests
│ └── migrations/ # SQLite migrations
├── package.json # npm dependencies
└── vite.config.ts # Vite configuration
| Document | Description |
|---|---|
docs/IDEA.md |
Project vision, design philosophy, threat model |
docs/ARCHITECTURE.md |
Module graph, component tree, data flow, dependencies |
docs/API.md |
Complete IPC command reference |
docs/CRYPTO.md |
Cryptographic specifications, blob format, key handling |
docs/SETUP.md |
Development setup guide |
docs/CHANGELOG.md |
Release history |
MIT License — see LICENSE for details.
- Tauri for the secure app framework
- Argon2 for password hashing
- AES-GCM for authenticated encryption
- Prism.js for syntax highlighting
Made with Rust + Tauri · cryptainer.forked.online · built by forked.online