Get Sealkeep
Menu

Private by design · by Nicholas Xerri

Your files. Your keys.
Your control.

Sealkeep encrypts your files on your own device before they reach cloud storage. No account, no analytics, no tracking. Only the credentials you choose can open a vault. Not your storage provider, and not me.

Release statusHow it works

In development: not released yet. No independent security audit yet.

The Sealkeep app with a vault unlocked: a Documents folder, and the details and version history of one file.
Sealkeep on a phone, showing the files in an unlocked vault.
The Sealkeep app, shown with sample files.
Encrypted on your deviceAny cloud folderNo accountNo analyticsReading is always free

Privacy first

Nothing about you.
Nothing about your files.

No account

No sign-up, no email address, no phone number. Install it and create a vault.

No analytics or tracking

The app has no analytics, advertising, crash reporting or tracking code. This website has none either.

Keys stay with you

Your password and keyfile never leave your device. There is no master key, no escrow and no recovery service.

Works offline

Unlocking, reading and exporting never need a network. Sealkeep never talks to your cloud provider.

Read the privacy policy

Encrypted before it leaves

Keep using your cloud.
Stop trusting it with plain files.

How Sealkeep protects a file On your device, Sealkeep encrypts each file with your vault key. The vault is an ordinary folder of small encrypted objects. Your sync service copies that folder, but it only ever sees encrypted data. Your deviceFiles you can readKeys that never leave encrypt Vault folder Small encrypted objects sync Any cloud folderSees encrypted data onlyCannot read or recover How Sealkeep protects a file On your device, Sealkeep encrypts each file with your vault key. The vault is an ordinary folder of small encrypted objects. Your sync service copies that folder, but it only ever sees encrypted data. Your deviceFiles you can readKeys that never leave encrypt Vault folder Small encrypted objects sync Any cloud folderSees encrypted data onlyCannot read or recover
Your sync service carries the vault. It never gets the key.

Encrypted on your device

Every file is encrypted with XChaCha20-Poly1305 before it is written to the vault. File names, folder structure and timestamps are encrypted too.

Works with the cloud you have

A vault is a folder of small encrypted objects. Put it in any synced folder. Sealkeep never talks to your storage provider.

No key with anyone else

There is no account, no master key, no escrow and no recovery phrase. Nobody can unlock your vault for you, including me.

Read the security model and its limits

A password.
And a keyfile, if you want one.

Open a vault with a password. For stronger protection, require a keyfile too: a small random file Sealkeep generates and you keep somewhere separate, such as a USB stick. Without it, a stolen copy of the vault can't be guessed open.

  • Passwords are stretched with Argon2id, 256 MiB and 3 passes by default, so every guess is slow and costly
  • Keyfile mode is enforced by the encryption itself, not by a check that could be skipped
  • Sealkeep refuses to save a keyfile inside the vault it protects

No reset. No recovery.

Lose your password, or your keyfile in keyfile mode, and the files are gone for good. That is the cost of a vault nobody else can open. Keep copies of keyfiles on separate media.

Creating a vault in Sealkeep: a strong password, and a keyfile saved to a USB stick, with a warning to keep it away from the vault.
Sealkeep on a tablet: a file selected, with four earlier versions that can be exported or restored.
Sealkeep on a phone: the version history of one file.

Nothing changed in place.
History comes for free.

Every change is a new encrypted commit, so every earlier version of a file stays until you clean it up. Pick a version and export it, or restore it with one tap.

Tablet and phone layouts shown. The iPhone, iPad and Android apps are planned and not released yet.

Version history

Every change is a new encrypted commit. Restore an earlier version of a file, or see what changed and when.

Several devices at once

Two devices can write to the same vault. If both change the same file, Sealkeep keeps both versions side by side and never merges them byte by byte.

Tampering is detected

Every object is authenticated. Altered, swapped or rolled-back data is reported, not silently accepted.

Open it like a drive

On Linux and macOS, mount an unlocked vault as a folder from the command line and use it from any app. Lock it and the plain view is gone. Not available on Windows.

Export any time

Export single files or a whole vault back to plain files. Unlocking, reading and exporting never need a licence or a network.

Desktop app and command line

A desktop app for everyday use, and a command line for scripts and servers. Passwords are always asked for, never passed as arguments.

Vault health

Check it yourself.
Any time.

Sealkeep checks a vault and tells you what it found: missing or damaged data, or files changed on two devices at once. A deep check decrypts and authenticates every chunk, so tampering can't hide.

  • Every object is authenticated, so altered or swapped data is reported, not used
  • Conflicting edits are kept side by side, never merged byte by byte
  • Storage details show the size of your files and of the encrypted copy
The vault health panel in Sealkeep: verified just now, storage details and a warning about one conflicting file.

Pricing

Pay to write.
Reading is always free.

A Sealkeep licence lets a device create vaults and add or change files. Without one, or after it ends, every vault still unlocks, reads and exports, offline. You are never locked out of your own files.

How licences work

A Nicholas Xerri app

Made in Malta.
Built to be distrusted.

I'm Nicholas Xerri, an independent developer. Sealkeep is designed so you don't have to trust me, your cloud provider or anyone else with your files. About me