Vault Explorer

An Android file manager for encrypted containers, drives, and directory vaults — no PC required.

VaultExplorer allows you to mount, browse, create, and manage encrypted volumes directly on your Android device. It supports VeraCrypt, LUKS1 / LUKS2, BitLocker, Cryptomator, gocryptfs, and CryFS volumes, as well as VHD / VHDX disk image files. Built with Flutter and powered by a custom C++ native engine (mbedTLS + FatFs + NTFS-3G + libext2fs + Dislocker), everything is decrypted and re-encrypted on-the-fly in memory with zero unencrypted temporary files written to disk.

✨ Features & Architecture

🔐 Supported Formats & Encryption Systems

Block-Level Containers & Disk Images VeraCrypt (.hc): Standard & embedded Hidden Volume support, custom PIM, additive keyfiles, and volume password changes. LUKS1 & LUKS2: Full support for xts-plain64 volumes. Keyslots backed by PBKDF2 or memory-hard Argon2id / Argon2i. Supports passphrase or keyfile substitution (cryptsetup --key-file). BitLocker: Decrypt and re-encrypt BitLocker partitions and BitLocker To Go volumes using user passwords or 48-digit numerical recovery keys (powered by an integrated dislocker backend). VHD & VHDX Images: Native Block Allocation Table (BAT) translation for both fixed and dynamic (expandable) virtual hard disk images containing VeraCrypt, LUKS, or BitLocker partitions. Directory-Based Vaults Cryptomator: Supports Vault Format 7 & 8 (cipher combos SIV_GCM and SIV_CTRMAC). Handles masterkey scrypt unwrapping, base32 directory ID hashing, and long-filename shortening (.c9s / name.c9r). gocryptfs: Modern default vault format support (GCMIV128, DirIV, EMENames, LongNames, Raw64, HKDF). EME filename encryption and 4KB chunk-level AES-GCM streaming. CryFS: Full format support (0.10). Dual-layer scrypt configuration decryption, block sharding storage, Merkle data tree indexing (CryfsDataTree), and directory blob serialization (CryfsDirBlob). Supports xchacha20-poly1305, aes-256-gcm, aes-128-gcm, aes-256-cfb, and aes-128-cfb.

🗝️ Cryptographic Algorithms & Ciphers

Block & Stream Ciphers: AES-256, AES-128, Serpent, Twofish, Camellia, Kuznyechik, and XChaCha20-Poly1305. Cipher Modes: XTS, GCM, CTR, CFB, EME (filename encryption), and AES-SIV (synthetic IV). VeraCrypt Cascades: All 15 single and multi-layer cipher combinations (e.g., AES-Twofish-Serpent, Kuznyechik-Serpent-Camellia, Camellia-Kuznyechik). Key Derivation Functions (KDF): PBKDF2 with SHA-512, SHA-256, Whirlpool, Streebog (512-bit), or BLAKE2s-256, alongside Argon2id and scrypt. Parallel Auto-Detect Engine: Multi-threaded C++ header derivation testing fast algorithms concurrently before memory-hard Argon2id iterations, with real-time UI progress.

🚀 Fast Direct Storage Access (POSIX Acceleration)

POSIX File System Bypass: Folder-based vaults (Cryptomator, gocryptfs, CryFS) can operate using direct POSIX file operations via Android's MANAGE_EXTERNAL_STORAGE permission, bypassing slow Storage Access Framework (SAF) document trees. Up to 1000x Speedup: Dramatically improves block reading, writing, and directory listing speeds—especially critical for CryFS vaults containing thousands of small block files.

💾 Filesystems & USB OTG Integration

Filesystem Drivers: Native C++ implementations of FAT32, exFAT (via ChaN FatFs), NTFS (via Tuxera NTFS-3G), and ext2 / ext3 / ext4 (via e2fsprogs libext2fs). Custom USB OTG Mass Storage Driver: Built-in SCSI Bulk-Only Transport (BOT) driver operating over Android’s USB Host API. No root required. Parses MBR/GPT partition tables and auto-locks volumes on device ejection. On-Device Format & Creation: Create and format brand-new VeraCrypt, LUKS1, LUKS2, Cryptomator, gocryptfs, or CryFS containers/vaults directly on internal storage or raw USB flash drives (with Quick Format or Full zero-fill options). Multi-Mount Manager: Mount up to 8 active volume slots simultaneously.

📁 Explorer, Media Streaming & Built-In Password Manager

File Explorer: Grid, detailed list, and compact view modes with breadcrumb navigation, instant search text highlighting, folder-size calculation, and custom sorting. In-Vault ZIP Archive Browser: Directly view and extract .zip archive contents inside an encrypted container without decrypting the archive to host storage. Background File Operations: Multi-threaded copy, move, import, and delete engine with LIFO queue prioritisation, pre-flight free-space calculation, conflict resolution sheets, and rollback on disk-full. Integrated Media Viewer: On-the-fly streaming for video/audio (FFmpeg-backed fvp engine, .srt/.vtt closed captions, playback speed, double-tap seek, audio visualizers) and images (pinch-to-zoom, 90° rotation, slideshow, gallery carousel) using virtual file handles. Encrypted Item Vault: Store logins, payment cards, secure notes, identities, bank accounts, and software licenses directly inside the vault as encrypted native JSON objects. Android SAF Provider: Integrates with Android's Storage Access Framework (ContainerDocumentsProvider), allowing third-party apps to securely open and save files inside unlocked containers via AppFuse proxy descriptors.

🛡️ App Security & Privacy

Zero Internet Permission: The app does not request or require network access (android.permission.INTERNET is absent). Master Lock: App-wide access protection with Master Password, Biometric Unlock (Fingerprint / Face via Android Keystore), or Pattern Lock, backed by exponential lockout backoff surviving app force-kills. Hardware-Bound Key Caching: Fast re-unlocks via AES-256-GCM derived key caching stored in the hardware-backed Android Keystore. 3-Tier Thumbnail Cache: In-Memory LRU → AES-GCM Encrypted Disk/In-Container Cache → Native Generation. Can be completely disabled for total privacy. Screen & Clipboard Protection: Screenshot/task-switcher preview blocking (FLAG_SECURE) and automatic clipboard sanitisation.