Secure Crypt is a cross-platform desktop application that protects your files and folders using AES-256-GCM — one of the strongest authenticated encryption standards available. With a simple point-and-click interface, you can lock any file or folder behind a password in seconds, with no configuration, no accounts, and no internet connection required.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/Anzi001/Secure-Crypt/llms.txt
Use this file to discover all available pages before exploring further.
What is Secure Crypt?
Secure Crypt is a lightweight encryption utility aimed at individuals, developers, and small teams who need a fast and reliable way to protect sensitive files on their local machine or when sharing files with others. Whether you are encrypting a confidential document before handing off a USB drive, locking a folder of private photos, or sharing an encrypted archive over email, Secure Crypt handles the cryptography for you without exposing any complexity. The application is distributed as a single standalone executable for Windows, macOS, and Linux. There is no installer, no background service, and no dependency on a Python runtime — everything you need is bundled inside the binary. When you lock a file, the original is replaced in place by an encrypted.scrypt file. When you lock a folder, the entire directory tree is zipped and encrypted into a single .scryptfold file. Either format can only be opened with the correct password.
How It Works
Every encrypted file Secure Crypt produces goes through the same deterministic pipeline. Key derivation. Your password is never used directly as an encryption key. Instead, it is passed through PBKDF2 with HMAC-SHA256, using a 16-byte random salt and 600,000 iterations, to derive a 32-byte (256-bit) key. The high iteration count makes brute-force attacks computationally expensive. Encryption. The derived key is used with AES-256-GCM to encrypt your file’s raw bytes. A fresh 12-byte nonce is generated randomly for every operation. AES-GCM is an authenticated encryption mode, meaning it also produces an authentication tag that detects any tampering with the ciphertext. Output format. The encrypted output is written as a single binary file with the following layout:M) or as a normal lock (N). Both the salt and nonce are stored alongside the ciphertext so that decryption requires only the password — no separate key file is ever needed.
Folder encryption. Folders are zipped into a ZIP archive in memory before the same AES-256-GCM pipeline is applied, producing a single .scryptfold file.
The cryptographic engine lives in
vault_engine.py, which exports functions such as crypt(), run_task(), open_file(), zip_dir(), and reg_assoc(). The graphical interface in main.py calls these functions and handles all user interaction via a Tkinter window running encryption tasks on a background thread so the UI always stays responsive.Key Features
AES-256-GCM Encryption
Every file is encrypted with AES-256-GCM using a key derived through PBKDF2-HMAC-SHA256 at 600,000 iterations. The GCM authentication tag ensures that any corruption or tampering is detected on decryption.
Quick View Mode
Decrypt a file or folder into a secure temporary directory, open it in its default application, make edits, then click Save Edits & Relock to re-encrypt automatically. The temp directory is deleted after relocking.
Folder Encryption
Lock an entire directory tree as a single
.scryptfold file. Secure Crypt zips the folder’s contents before encrypting, preserving directory structure, and unpacks it fully on unlock.Force Lock / Mandatory Lock
Enable the Force Password Every Time checkbox before locking to write a Mandatory Lock flag (
M) into the file header. Files with this flag cannot be permanently unlocked — they can only be accessed through Quick View, ensuring a password is always required.Cross-Platform Executables
Distributed as self-contained binaries for Windows (
SecureCrypt_Win.exe), macOS (SecureCrypt_Mac.app), and Linux (SecureCrypt_Linux). No Python installation or additional dependencies are required on any platform.Random Salt and Nonce Per File
Each encryption operation generates a fresh 16-byte salt and a 12-byte nonce via
os.urandom(). No two encryptions of the same file produce the same output, eliminating patterns that could aid cryptanalysis.File Extensions
Secure Crypt uses two custom file extensions to distinguish encrypted output from ordinary files..scrypt — produced when you lock a single file using Lock File. The extension is appended to the original filename (e.g., report.pdf becomes report.pdf.scrypt). The original file is deleted after encryption succeeds.
.scryptfold — produced when you lock a folder using Lock Folder. The entire directory is compressed and encrypted into a single file (e.g., project/ becomes project.scryptfold). The original folder is deleted after encryption succeeds.
Both formats use identical internal binary structures. The only difference is the content before encryption: raw file bytes for .scrypt, and a ZIP archive for .scryptfold.