Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Anzi001/Secure-Crypt/llms.txt

Use this file to discover all available pages before exploring further.

Secure Crypt is a cross-platform desktop application that protects your files and folders using AES-256-GCM — one of the strongest authenticated encryption standards available. With a simple point-and-click interface, you can lock any file or folder behind a password in seconds, with no configuration, no accounts, and no internet connection required.

What is Secure Crypt?

Secure Crypt is a lightweight encryption utility aimed at individuals, developers, and small teams who need a fast and reliable way to protect sensitive files on their local machine or when sharing files with others. Whether you are encrypting a confidential document before handing off a USB drive, locking a folder of private photos, or sharing an encrypted archive over email, Secure Crypt handles the cryptography for you without exposing any complexity. The application is distributed as a single standalone executable for Windows, macOS, and Linux. There is no installer, no background service, and no dependency on a Python runtime — everything you need is bundled inside the binary. When you lock a file, the original is replaced in place by an encrypted .scrypt file. When you lock a folder, the entire directory tree is zipped and encrypted into a single .scryptfold file. Either format can only be opened with the correct password.

How It Works

Every encrypted file Secure Crypt produces goes through the same deterministic pipeline. Key derivation. Your password is never used directly as an encryption key. Instead, it is passed through PBKDF2 with HMAC-SHA256, using a 16-byte random salt and 600,000 iterations, to derive a 32-byte (256-bit) key. The high iteration count makes brute-force attacks computationally expensive. Encryption. The derived key is used with AES-256-GCM to encrypt your file’s raw bytes. A fresh 12-byte nonce is generated randomly for every operation. AES-GCM is an authenticated encryption mode, meaning it also produces an authentication tag that detects any tampering with the ciphertext. Output format. The encrypted output is written as a single binary file with the following layout:
[1 byte: lock flag] [16 bytes: salt] [12 bytes: nonce] [N bytes: ciphertext + GCM tag]
The lock flag byte records whether the file was encrypted with Force Lock / Mandatory Lock enabled (M) or as a normal lock (N). Both the salt and nonce are stored alongside the ciphertext so that decryption requires only the password — no separate key file is ever needed. Folder encryption. Folders are zipped into a ZIP archive in memory before the same AES-256-GCM pipeline is applied, producing a single .scryptfold file.
The cryptographic engine lives in vault_engine.py, which exports functions such as crypt(), run_task(), open_file(), zip_dir(), and reg_assoc(). The graphical interface in main.py calls these functions and handles all user interaction via a Tkinter window running encryption tasks on a background thread so the UI always stays responsive.

Key Features

AES-256-GCM Encryption

Every file is encrypted with AES-256-GCM using a key derived through PBKDF2-HMAC-SHA256 at 600,000 iterations. The GCM authentication tag ensures that any corruption or tampering is detected on decryption.

Quick View Mode

Decrypt a file or folder into a secure temporary directory, open it in its default application, make edits, then click Save Edits & Relock to re-encrypt automatically. The temp directory is deleted after relocking.

Folder Encryption

Lock an entire directory tree as a single .scryptfold file. Secure Crypt zips the folder’s contents before encrypting, preserving directory structure, and unpacks it fully on unlock.

Force Lock / Mandatory Lock

Enable the Force Password Every Time checkbox before locking to write a Mandatory Lock flag (M) into the file header. Files with this flag cannot be permanently unlocked — they can only be accessed through Quick View, ensuring a password is always required.

Cross-Platform Executables

Distributed as self-contained binaries for Windows (SecureCrypt_Win.exe), macOS (SecureCrypt_Mac.app), and Linux (SecureCrypt_Linux). No Python installation or additional dependencies are required on any platform.

Random Salt and Nonce Per File

Each encryption operation generates a fresh 16-byte salt and a 12-byte nonce via os.urandom(). No two encryptions of the same file produce the same output, eliminating patterns that could aid cryptanalysis.

File Extensions

Secure Crypt uses two custom file extensions to distinguish encrypted output from ordinary files. .scrypt — produced when you lock a single file using Lock File. The extension is appended to the original filename (e.g., report.pdf becomes report.pdf.scrypt). The original file is deleted after encryption succeeds. .scryptfold — produced when you lock a folder using Lock Folder. The entire directory is compressed and encrypted into a single file (e.g., project/ becomes project.scryptfold). The original folder is deleted after encryption succeeds. Both formats use identical internal binary structures. The only difference is the content before encryption: raw file bytes for .scrypt, and a ZIP archive for .scryptfold.

Build docs developers (and LLMs) love