Zero trust. Cryptographic proof.

SecureCrypt is built so that neither the server, the network, nor us can read your files or falsify your audit trail.

What happens when you share a file

Four steps. Every one verifiable.

1

Encrypt locally

Your device generates a random 256-bit key and encrypts the file with AES-256-GCM. No plaintext ever leaves your machine.

2

Wrap the key

The AES key is encrypted with the recipient's RSA-2048 public key, fetched from the chain. Only their private key can unwrap it.

3

Upload & record

Ciphertext is uploaded directly to cloud storage over HTTPS. A signed transaction is broadcast to the CometBFT chain, recording the share permanently.

4

Recipient decrypts

The recipient's app checks chain state to confirm the share is active, fetches the wrapped key, decrypts it locally with their private key, downloads the ciphertext, and decrypts the file.

Under the hood

Click any card for technical detail.

🔐

AES-256-GCM Encryption

Authenticated encryption. Any bit-flip in the ciphertext is detected before decryption.

Click to expand
Algorithm: AES-256-GCM with a 96-bit random IV per file.

GCM mode produces an authentication tag that covers both the ciphertext and optional associated data. Decryption fails loudly if the tag doesn't verify - the attacker cannot silently corrupt a file in transit or at rest.

The AES key itself never appears on the network or in storage; only the RSA-wrapped copy does.
🔑

RSA-2048 Key Exchange

Your identity is a keypair. Shares are sealed with the recipient's on-chain public key.

Click to expand
Key generation: RSA-2048 keypair generated locally on first launch. The private key never leaves your device.

Registration: The public key is registered on-chain with a SHA-256 fingerprint. Anyone sharing a file with you fetches this fingerprint and verifies the key before use.

Padding: OAEP with SHA-256 is used to wrap the AES key - secure against chosen-ciphertext attacks.
⛓️

Immutable Audit Log

Every operation is signed, broadcast, and finalized on a CometBFT ABCI chain.

Click to expand
Chain: CometBFT (formerly Tendermint) with a custom ABCI application.

Each transaction includes: block height, transaction hash, RSA signature, key fingerprint, operation type, and timestamp. The chain is append-only - validators cannot silently edit or delete finalized entries.

Verification: The desktop app independently re-verifies every entry it reads: block hash, tx hash, RSA signature, and key fingerprint - without trusting the server's response.
✅

Client-side Verification

The app independently checks every audit entry. No trust in the server required.

Click to expand
When the app fetches your audit history, it doesn't just display what the server sends. It re-derives:

  • Block hash from the raw block data
  • Transaction hash from the raw tx bytes
  • RSA signature validity against the sender's on-chain public key
  • Key fingerprint match against the registered key

Any discrepancy is flagged as a tampered entry.
🔄

Recovery & Key Rotation

BIP-39 recovery phrase. Key rotation is logged on-chain so history stays intact.

Click to expand
Recovery: A 24-word BIP-39 mnemonic is generated alongside your keypair. Entering it on a new device restores your private key and re-establishes your on-chain identity.

Key rotation: When you rotate your keypair, a signed rotation transaction links the old fingerprint to the new one on-chain. Historical shares reference the old key fingerprint and remain verifiable. New shares use the new key.
📊

Audit Export

Export your full verifiable audit log as PDF, CSV, or JSON for compliance and legal discovery.

Click to expand
Formats: PDF (human-readable with signatures), CSV (for spreadsheet analysis), JSON (machine-readable with full tx data).

Each exported entry includes the raw transaction bytes and RSA signature so the recipient of the export can independently verify authenticity - even without running the SecureCrypt app.

Suitable for GDPR data access requests, legal discovery, and compliance audits.

What you don't have to trust

The security model is designed to minimize assumptions.

✓
Not the storage backend Cloud storage holds only ciphertext. It has no key material and cannot decrypt your files under any circumstances.
✓
Not the chain operator Entries are RSA-signed by the sender. A compromised validator cannot forge a valid signature.
✓
Not us SecureCrypt has no backdoor key. We cannot decrypt your files or impersonate your identity.
✓
Not the network Files are encrypted before upload. An in-transit attacker sees only ciphertext and RSA-wrapped keys.
✓
Not the recipient's client Revocation is enforced server-side. A malicious client cannot bypass an on-chain revoke.

Ready to try it?

Alpha release - free to use. Windows & Linux available now.

Download for Windows & Linux