Vault Explorer

An Android file manager, and viewer for encrypted containers, drives, and directory vaults — no PC required.

VaultExplorer allows you to mount, browse, create, edit, and manage encrypted volumes directly on your Android device. It supports VeraCrypt, LUKS1 / LUKS2, BitLocker, Cryptomator, gocryptfs, and CryFS volumes, as well as VHD / VHDX virtual disk images. Built with Flutter and powered by a custom high-performance C++ native engine (mbedTLS + FatFs + NTFS-3G + libext2fs + Dislocker), everything is decrypted and re-encrypted on-the-fly in memory with zero unencrypted temporary files written to host storage.

✨ Features & Architecture

🔐 Volume & Encryption Systems Block-Level Containers & Disk Images VeraCrypt (.hc): Standard & embedded Hidden Volume support, custom PIM, additive keyfiles, multi-layer cipher cascades, and in-place password modification. LUKS1 & LUKS2: Full support for xts-plain64 volumes. Keyslots backed by PBKDF2 or memory-hard Argon2id / Argon2i. Supports passphrases or binary keyfiles (cryptsetup --key-file). BitLocker: Decrypt and re-encrypt BitLocker partitions and BitLocker To Go volumes using user passwords or 48-digit numerical recovery keys (powered by a custom dislocker C++ virtual I/O engine). VHD & VHDX Images: Native Block Allocation Table (BAT) translation for both fixed and dynamic (expandable) virtual hard disk images hosting VeraCrypt, LUKS, or BitLocker filesystems. Directory-Based Vaults Cryptomator: Full support for Vault Formats 7 & 8 (ciphers SIV_GCM and SIV_CTRMAC). Handles masterkey scrypt unwrapping, base32 directory ID hashing, and long-filename shortening (.c9s / name.c9r). gocryptfs: Modern default format support (GCMIV128, DirIV, EMENames, LongNames, Raw64, HKDF). Features EME filename encryption and 4KB chunk-level AES-GCM streaming. CryFS: Format 0.10 support with dual-layer scrypt config unwrapping, block sharding storage, Merkle data tree indexing (CryfsDataTree), and directory blob serialization (CryfsDirBlob). Supports xchacha20-poly1305, aes-256-gcm, aes-128-gcm, aes-256-cfb, and aes-128-cfb.

🗝️ Cryptographic Algorithms & Native Primitives Block & Stream Ciphers: AES-256, AES-128, Serpent, Twofish, Camellia, Kuznyechik, and XChaCha20-Poly1305. Cipher Modes: XTS, GCM, CTR, CFB, EME (wide-block filename encryption), and AES-SIV (synthetic IV). VeraCrypt Cascades: All 15 single and multi-layer cipher combinations (e.g., AES-Twofish-Serpent, Kuznyechik-Serpent-Camellia, Camellia-Kuznyechik). Key Derivation Functions (KDF): PBKDF2 with SHA-512, SHA-256, Whirlpool, Streebog (512-bit), or BLAKE2s-256, alongside Argon2id/i and scrypt. Hardware Acceleration: Built with ARMv8 Cryptography Extensions (-march=armv8-a+crypto+sha2) in mbedTLS for near-instant PBKDF2/AES execution on modern ARM CPUs. Parallel Auto-Detect Engine: Multi-threaded C++ header derivation testing candidate KDFs and ciphers concurrently with real-time progress callbacks to the UI.

🚀 POSIX Storage Acceleration POSIX File System Bypass: Directory vaults (Cryptomator, gocryptfs, CryFS) automatically use direct POSIX file I/O when MANAGE_EXTERNAL_STORAGE or direct path access is granted, bypassing slow Android Storage Access Framework (SAF) document tree queries. Up to 1000x Speedup: Massive performance gains for directory listing, reading, and writing—essential for CryFS vaults with tens of thousands of sharded block files.

💾 Filesystems & USB OTG Driver Native Filesystem Engines: FAT12 / FAT16 / FAT32 & exFAT via ChaN's FatFs. NTFS via Tuxera NTFS-3G (includes embedded mkntfs formatter). ext2 / ext3 / ext4 via e2fsprogs libext2fs. Custom USB OTG Mass Storage Driver: Built-in SCSI Bulk-Only Transport (BOT) driver operating directly over Android's USB Host API (no root required). Supports 10-byte and 16-byte CDBs with dynamic sector-chunk backoff (1024 down to 8 sectors) for maximum hardware compatibility, MBR partition parsing, and instant auto-locking upon drive disconnection. On-Device Volume Creation: Format and initialize brand-new VeraCrypt, LUKS1, LUKS2, Cryptomator, gocryptfs, or CryFS containers directly on device storage or raw USB drives (Quick Format or Full zero-fill). Multi-Mount Manager: Simultaneously mount up to 8 active volume slots.

📁 In-Vault Studio, Media Streaming & Editors Multi-Layout File Explorer: Detailed List, Grid, and Masonry view modes with gesture-based pinch-to-zoom column adjustments, breadcrumbs, search term highlighting, and instant folder size calculations. Direct Vault Camera: Capture photos and record video (H.264 / HEVC) directly into encrypted containers without writing unencrypted temporary files to host storage. PDF Annotator & Editor: View PDF documents, draw markup annotations (highlights, underlines, sticky notes), rotate pages, delete pages, undo/redo edits, and commit changes back to the vault. Web & HTML Viewer: Isolated WebView platform view rendering HTML, CSS, JavaScript, and linked web assets directly out of the vault via a local secure origin (https://vault-local.internal). Built-In Text Editor: Create, edit, and save plain text, code, or markdown files directly inside encrypted volumes. In-Vault ZIP Archive Browser: Inspect and extract .zip archive contents directly inside an encrypted volume without unencrypting archives to the host filesystem. Advanced Media Streaming: Stream video and audio (AndroidX Media3/ExoPlayer via the video_player plugin, .srt/.vtt subtitles, custom speed, double-tap seek, audio visualizer) and view photos (pinch-to-zoom, 90° rotation, slideshow, gallery carousel overlay, diagnostics sheet). Encrypted Item Vault: Store Passwords, Bank Accounts, Payment Cards, Secure Notes, Identities, and Software Licenses directly inside the volume as encrypted JSON objects with customizable key-value fields and secret masking. Android SAF Provider & Subfolder Mounts: Expose entire mounted containers or specific subfolders (subFolderMounts) as Android Storage Access Framework (SAF) roots (ContainerDocumentsProvider), allowing third-party Android apps to open and save files inside unlocked volumes via AppFuse proxy descriptors.

🛡️ Security & Privacy Zero Internet Permission: The application binary does not request or possess network access (android.permission.INTERNET is absent). Master Lock: Protect the entire app with a Master Password, Biometric Unlock (Fingerprint / Face via Android Keystore), or Pattern Lock backed by exponential lockout backoff surviving app force-kills. Hardware-Bound Key Caching: Optional AES-256-GCM key caching stored securely in the hardware-backed Android Keystore for instant re-unlocks. 3-Tier Thumbnail Cache: In-Memory LRU → AES-256-GCM Encrypted Disk/In-Container Cache → Native Generation. Can be completely disabled for maximum privacy. Screen & Clipboard Protection: Prevents screenshots and task-switcher previews (FLAG_SECURE) with automatic corrupt clipboard clearing upon app focus.