Kryptic - Secure File Vault

Asadullahil Galib

About this app

Kryptic encrypts files on your device and nowhere else.

Pick a file, choose a passphrase, and Kryptic produces a .kenc container that
only that passphrase can open. There is no account to create, no server to
trust, and no network connection involved at any point.


WHAT IT ACTUALLY DOES

• AES-256-GCM encryption, using your device's own cryptographic provider
• Keys derived from your passphrase with PBKDF2-HMAC-SHA256 at 600,000
iterations — the current OWASP recommendation for this function
• Every 64 KiB block carries its own 128-bit authentication tag, so a file
that has been altered, truncated, or reassembled out of order fails to
decrypt instead of quietly producing wrong data
• The original filename is stored inside the encrypted portion of the
container, so it is not readable until your passphrase is verified
• Files are processed in a stream: a 5 GB file uses the same memory as a
5 MB one


NO NETWORK, AT ALL

Kryptic does not request internet permission. This is not a promise about
what the app chooses to do — without that permission Android will not let
the process open a network connection. There is no analytics, no crash
reporting, no advertising ID, and no telemetry of any kind, because there is
nowhere for any of it to go.


YOUR FILES OUTLIVE THIS APP

An encrypted file you cannot open is not backed up, it is lost. So the .kenc
container format is fully documented, and Kryptic ships standalone Python,
Node.js and Go scripts that decrypt your files on any computer — no Android,
no Kryptic, no installation beyond the language itself. Two of the three need
nothing but their standard library.

The scripts are inside the app, and the app can export the whole guide as a
PDF to keep alongside your backups.


APP LOCK

Optionally require your device screen lock — whatever you already use, be
that fingerprint, face, PIN, pattern or password — every time Kryptic opens
or returns from the background. Kryptic never sees your biometric data;
Android handles the check and reports only success or failure.

Screenshots and screen recording are blocked inside the app.


PLEASE READ THIS PART

There is no password reset, and there is no backdoor. Your passphrase is
never stored and never transmitted, and no master key exists anywhere. If you
forget it, the files encrypted with it cannot be recovered — not by you, and
not by us. That is the property that makes the encryption worth having, and
it is not reversible.

Keep a backup of your original files until you have confirmed you can decrypt
the encrypted copy.


WHAT KRYPTIC DOES NOT DO

• It does not compress files
• It does not sync, back up, or upload anything
• It does not hide that a file is encrypted — .kenc containers are
identifiable as such
• It does not protect a file already on a compromised device


Open beta. Feedback and bug reports are welcome at [e-mail].

What’s new

First public beta of Kryptic.

• AES-256-GCM encryption, keys derived with PBKDF2-HMAC-SHA256 (600,000 rounds)
• Every 64 KiB block separately authenticated — altered files fail to decrypt
• No internet permission, no account, no telemetry
• Bundled Python, Node.js and Go scripts decrypt your files on any computer
• Optional app lock using your device screen lock

There is no password reset. Keep a backup of your originals.