StrawHut

StrawHut is a fully local knowledge card encryption tool. Your content is encrypted before it ever leaves your device — no servers, no network requests, no persistent storage. Your knowledge, your keys, your control. In addition to rich text knowledge cards, StrawHut now supports file encryption mode — encrypt any type of file (PDF, images, audio, video, etc.), not just rich text content.

✨ Privacy Core: Knowledge Card as PNG Image — Encrypted knowledge is embedded into PNG image metadata. The image looks like a beautiful knowledge cover that any image viewer can display, but only StrawHut can read the content with the correct key. Share images via WeChat, Photos, AirDrop, or any channel — breaking the barrier of mobile sharing. File encryption mode uses a unified binary .straw container format for maximum flexibility.

🌟 Vision: Let knowledge flow securely between people. Creators control their content, readers gain value, privacy is never compromised.

🔐 Privacy Promise Promise Description 🚫 Zero Network Requests The app never sends or receives any network data; all content is processed locally 🚫 Zero Data Collection No user information, usage data, or analytics are collected 🚫 Zero Persistent Storage No knowledge cards, keys, drafts, or history are saved except for passphrases you explicitly save 🔒 End-to-End Encryption Content is encrypted locally with AES-256-GCM; only those with the key can decrypt 🕶️ Anonymous Publishing One-click anonymous mode; creator identity is completely hidden 🗝️ Key Is Permission Key files are independently managed by users; no key means no access; no backdoors ✨ Features Feature Description 🔒 End-to-End Encryption AES-256-GCM with native API hardware acceleration (AES-NI) 🖼️ Knowledge as Image Encrypted content embedded in PNG metadata — beautiful cover, easy mobile sharing 🤝 Passphrase Key Derive encryption key from a passphrase (PBKDF2-HMAC-SHA256), perfect for verbal sharing 📊 Passphrase Strength Real-time strength assessment (Very Weak / Weak / Medium / Strong) with weak passphrase confirmation 🔐 Passphrase Vault Securely save passphrases locally, auto-match to decrypt incoming cards 🏠 Purely Local No servers, no network — data never leaves your device 🗝️ Key File Mode System-generated high-strength random keys, stored in separate .key files 🕶️ Anonymous Mode One-click anonymous publishing, fully protects creator identity 📄 Dual Format Export as .straw files or .png images, choose by scenario 🛡️ Integrity Check SHA-256 hash verification prevents tampering 🧹 Zero Traces No cards, keys, or drafts stored except for user-saved passphrases 🛑 Decryption Cancellation Cancel in-progress decryption and integrity verification at any time 🔐 Vault Selection Decrypt Select a passphrase from vault to decrypt, instead of auto-matching 📊 Decrypt Progress Real-time percentage display during decryption and integrity verification 📁 File Encryption Mode Encrypt any type of file, decrypt and save to local storage 📊 Encryption Progress Real-time progress display with percentage for both encryption and decryption 💾 Smart File Saving Android: media files saved to gallery, other files to Downloads; Desktop: system save dialog 📦 Binary Container Format Unified binary .straw format with chunked encryption for maximum compatibility 🗂️ Large File Support Chunked encryption and streaming processing for files of any size 🧹 Temp File Management Auto-cleanup of decrypted temp files — no traces left behind 🔄 Migration Tool Convert old .straw files to new binary container format 🖼️ PNG Knowledge Card — Image Is Knowledge When publishing a knowledge card, you can embed encrypted content into a PNG image. The generated image looks like a carefully designed cover:

┌─────────────────────────────────────────┐ │ STRAWHUT │ │ ━━━━ │ │ │ │ ┌ 🔒 Encrypted ┐ │ │ │ │ Getting Started with Security │ │ │ │ [Security] [Basics] [Notes] │ │ A guide about network security... │ │ │ │ Author: Anonymous │ │ 2026.05.04 │ └─────────────────────────────────────────┘ It's still a valid PNG image — any image viewer can display the cover. But beneath the cover, the full encrypted knowledge content is hidden in the PNG metadata.

⚠️ Note: PNG export is only available in rich text mode. File encryption mode uses the .straw binary container format instead.

🔄 How It Works Creator Reader │ │ ├── 📝 Choose content source │ │ ├── Rich text → knowledge card │ │ └── File → file encryption mode │ ├── 🚀 Publish → choose format │ │ ├── Rich text → .png or .straw │ │ └── File → .straw binary container │ ├── 🎨 Custom or auto-generated cover │ ├── 📦 Content encrypted │ ├── 💾 Save encrypted file │ │ │ ════ [ Encrypted file shared via any channel ] ════ (WeChat / Photos / AirDrop / Email / ...) │ │ │ 📥 Received encrypted file │ 📂 Open with StrawHut │ 🔓 Enter key or upload .key file │ ✅ Integrity check passed │ 📖 Read text content or save file ⚠️ Important: When sharing as an image, always send the original image. Social media compression will strip the metadata containing encrypted content.

🔐 Encryption AES-256-GCM — Industry-standard authenticated encryption with native hardware acceleration (AES-NI) PBKDF2-HMAC-SHA256 — 100,000 iterations for passphrase-based key derivation, with native API acceleration 12-byte IV — NIST SP 800-38D recommended, with backward compatibility for 16-byte IV CSPRNG — Cryptographically secure random number generation (Android SecureRandom / Windows BCryptGenRandom) Native-first architecture — Platform native crypto APIs with automatic fallback to pure Dart implementation Chunked encryption — Large files are split into chunks, each encrypted independently with its own IV, enabling streaming processing and memory-efficient handling of files of any size. Chunked encryption runs each chunk in a separate isolate via Flutter.compute(), preventing UI freezing and enabling real-time progress display. PayloadMetadata — Each payload carries metadata (content type, file name, size, chunk info) to enable smart content display after decryption Binary container format — Unified .straw binary format with header, metadata, and encrypted chunk sections for both rich text and file encryption modes