Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Anzi001/Secure-Crypt/llms.txt

Use this file to discover all available pages before exploring further.

This page is the authoritative specification for the binary file format produced by Secure Crypt. Every file locked by the application — whether a single document or an entire folder — is written with a fixed 29-byte header followed by variable-length AES-GCM ciphertext. Understanding this layout is useful for auditing, interoperability, or writing your own tooling that reads Secure Crypt files.

​
File Extensions

Secure Crypt uses two distinct file extensions to distinguish between encrypted files and encrypted folders.
ExtensionContentsProduced by
.scryptEncrypted single fileLock File or Quick View re-lock
.scryptfoldEncrypted folder (zipped archive)Lock Folder or Quick View Folder re-lock
The original file extension is preserved — .scrypt is appended to the existing extension rather than replacing it. The same rule applies to .scryptfold for folders. Examples:
OriginalEncrypted
report.pdfreport.pdf.scrypt
photo.jpgphoto.jpg.scrypt
notes.txtnotes.txt.scrypt
my-folder/my-folder.scryptfold

​
Binary Layout

Every .scrypt and .scryptfold file begins with a 29-byte header. The ciphertext begins immediately at byte offset 29 and extends to the end of the file.
FieldOffsetSizeDescription
Flag01 byte0x4D (ASCII 'M') for Force Lock files; any other byte for standard files
Salt116 bytesRandom PBKDF2 salt generated with os.urandom(16)
Nonce1712 bytesRandom AES-GCM nonce generated with os.urandom(12)
Ciphertext29variableAES-GCM ciphertext with the 16-byte authentication tag appended
The following Python snippet shows how to read and split these fields from a raw .scrypt file without decrypting it: 
with open('file.scrypt', 'rb') as f:
    data = f.read()

flag    = data[0:1]    # b'M' = mandatory/force lock; anything else = standard
salt    = data[1:17]   # 16-byte PBKDF2 salt
nonce   = data[17:29]  # 12-byte AES-GCM nonce
cipher  = data[29:]    # AES-GCM ciphertext + 16-byte authentication tag
Because the salt and nonce are generated freshly with os.urandom each time a file is encrypted — including after every Quick View re-lock — encrypting the same plaintext twice with the same password will produce two completely different ciphertext blobs. No two .scrypt files are ever identical even if they protect the same data.

​
Folder Archive Format

.scryptfold files store an encrypted ZIP archive of the original folder. The encryption process for folders works in two stages:
  1. The entire folder tree is compressed into an in-memory ZIP archive using Python’s zipfile module.
  2. The resulting ZIP bytes are encrypted as a single binary blob using AES-256-GCM, then written to disk with the standard 29-byte header.
When decrypted, the plaintext is a valid, self-contained .zip file that reproduces the original folder hierarchy exactly. During a Quick View or Unlock Folder operation, Secure Crypt writes this ZIP to the OS temporary directory and extracts it with zipfile.ZipFile.extractall() before opening the folder.
The intermediate ZIP file is never written as a named archive on your disk during a Lock Folder operation — it exists only in memory before encryption. During Quick View, the temporary extraction directory is cleaned up with shutil.rmtree() after re-locking.

​
Flag Byte Values

The first byte of every Secure Crypt file is a flag that controls how the file may be accessed.
ValueHexMeaning
ASCII 'M'0x4DMandatory / Force Lock — file was encrypted with the Force Password Every Time option. Permanent unlocking is blocked; Quick View only.
Any other byte—Standard encrypted file — can be permanently unlocked with the correct password.
When Secure Crypt’s Unlock File or Unlock Folder button is used, the application reads this flag byte before prompting for a password. If the byte equals b'M', the unlock is rejected immediately with a dialog titled "Access Denied" and the message "Mandatory lock. Use Quick View." — no password is ever tried for a permanent unlock of a Force Lock file.

Build docs developers (and LLMs) love

Get started for freeTalk to us