Skip to content
Skip to content
Get started
/Apps

Apps

Web app

The zcrypt web app is the full product in a browser tab: a real encrypted drive with client-side encryption, a single session lock, and an optional way to stay unlocked on a device you trust.

Runs in your browser

zcrypt works in any modern browser on desktop or mobile. There is nothing to install. All encryption and decryption happen on your device using the Web Crypto API, so your files are sealed and opened locally and the server only ever handles ciphertext.

The vault lock

zcrypt uses one passphrase to unlock everything for a session. Rather than prompting you per file or per action, the app shows a single lock indicator, a small pill in the interface, and a single unlock modal. Enter your vault passphrase once and the whole vault opens for that session.

  • •Locked: folder names show as placeholders and nothing can be decrypted. The pill invites you to unlock.
  • •Unlocked: your passphrase is held in memory for the session so previews, downloads, and search work without re-prompting.
  • •By default a session unlock lasts 15 minutes of activity and then auto-locks, dropping the passphrase and any decrypted data from memory.
Folders you protect with their own password are the one exception: they ask for that folder's password the first time you open them in a session. See per-folder encryption.

Keep me unlocked on this device

On a device that's yours, you can opt in to keep me unlocked on this device so a page reload doesn't make you re-enter your passphrase. This is convenience with real engineering behind it, not a plaintext shortcut.

  • •Your passphrase is encrypted at rest and stored in IndexedDB, never in localStorage and never as plaintext.
  • •It's encrypted with an AES-GCM key that is non-extractable: the browser can use the key to decrypt but its raw bytes can never be read back out, even by zcrypt's own code.
  • •The passphrase never leaves your device and is never sent to the server: turning this on changes nothing about what the server can see.
  • •Locking the vault, or switching the option off, wipes the on-device copy so a later reload stays locked.
  • •It is off by default. While it is on, anyone who can use this browser profile can open your vault, because the key sits on the same device as the ciphertext. Only turn it on for a device nobody else uses.

The honest trade-off

Staying unlocked on a device is strictly your opt-in choice. The non-extractable key makes it far safer than a stored plaintext string, but it is not a defense against malware or a hostile script already running in your browser: such code could ask the key to decrypt. Leave it off on shared or untrusted machines.

Background notifications

Uploads and downloads keep running while you work in other tabs. With your permission, zcrypt can post a browser notification when a transfer finishes, so you don't have to babysit a long job. Notifications are shown only while the zcrypt tab is in the background (when it's focused, the in-app progress UI is enough) and they request permission only when there's something worth telling you.

Notifications are entirely local to your browser and purely informational. Denying the permission has no effect on transfers; you just won't get the desktop pop-up.

Where to go next