by zevbuild · Encrypt and decrypt files and entire folders directly in your browser — zero uploads, zero tracking, 100% private & offline.
-3b82f6?style=for-the-badge){kind=icon}
-06b6d4?style=for-the-badge){kind=icon}
🟢 Current stable release — v6.8 (
.zevformat / WEB-VERSION-36): military-grade security by default with multi-worker parallel AEAD streaming pipeline, zero-copy transferable buffers, ephemeral session key caching, rich in-vault image lightbox with pan/zoom/rotate, code & text document viewer with line numbers and 1-tap copy, zero-knowledge session zeroization, active telemetry HUD with worker core count and ETA, enhanced Cinema player controls, and dedicated native Android APK (com.zevbuild.zevsafe).
PBKDF2-SHA512 · 600,000 iterations · 32-byte salt · Multi-Worker 4 MB Chunked AES-256-GCM (ZV3\0) · Parallel WorkerPool (4–8 threads) with bounded backpressure (<105 MB RAM) · Zero-Copy Transferable ArrayBuffers · Instant <100ms Vault Explorer with Ephemeral CryptoKey Caching (<15ms extraction) · In-Vault Image Lightbox Viewer (25%–500% zoom, pan, rotate, dimensions) · In-Vault Code & Text Document Viewer (line numbers, wrap, 1-tap copy) · Zero-Knowledge Memory Scrubbing & Zeroization (.fill(0)) · Real-Time Telemetry HUD (MB/s, Worker Badge, Live ETA) · In-Browser Cinema Media Player with Static DOM Preservation, Volume Slider & Full Keyboard Shortcuts · Dedicated native Android app with ForegroundService & ExoPlayer · Progressive Web App (v36).
ZevSafe is a zero-trust, client-side encryption portal designed to lock sensitive files and directory hierarchies into single portable encrypted vaults (.zev). It executes entirely within your browser sandbox leveraging the native W3C Web Crypto API — no backend servers, no cloud telemetry, no accounts, and no data transmission over the network.
Once loaded, ZevSafe works 100% offline and air-gapped. It employs v3 Low-RAM Streaming (ZV3\0 / PBKDF2-SHA512 / 600,000 rounds) by default so users can compress, encrypt, and decrypt up to 5 GB on mobile and desktop browsers without out-of-memory crashes, supports an optional Keyfile second factor, provides an instant Decrypted Vault Explorer with an in-browser Cinema Media Player, a high-res Image Lightbox, a Code & Text Document Viewer, and maintains 100% backward compatibility with v2 Standard and v1 Legacy vaults.
- Zero-knowledge backup: Encrypting personal archives before storing on USB flash drives, external SSDs, or public cloud storage.
- Air-gapped security: Encrypting and decrypting data on completely offline machines or in airplane mode.
- Two-factor protection: Pairing a passphrase with a physical keyfile (e.g., a photo, key file, or document) so neither factor alone can unlock the vault.
- Instant media streaming: Playing encrypted multi-GB videos and audio files directly inside the browser without downloading decrypted files to disk.
- In-vault photo and code inspection: Zooming into decrypted high-resolution photos and inspecting source code / text documents directly in the browser with zero disk persistence.
- Selective file extraction: Unlocking a 5 GB vault catalog in < 100 ms (
< 15 MB RAM) and extracting single files by decrypting only their specific 4 MB chunk span.
| Feature | Description |
|---|---|
| 🔐 AES-256-GCM Authenticated Encryption | Military-grade authenticated cipher guaranteeing confidentiality and detecting any bit-flipping, chunk reordering, or file tampering. |
⚡ Multi-Worker Streaming Pipeline (ZV3\0) |
Streams ZIP64 compression (CompressionStream('deflate-raw')) and parallel 4 MB chunked AES-256-GCM across a dynamic Web Worker pool (clamped to 4–8 cores with credit-based flow control), utilizing zero-copy Transferable buffers to keep peak browser heap under 105 MB. |
| 🛡️ PBKDF2-SHA512 (600,000 Iterations) | Key stretching with 600,000 iterations and a 32-byte CSPRNG random salt offloaded to a Web Worker so the UI stays at 60 FPS. |
| 🗝️ Keyfile Two-Factor Authentication (2FA) | Mixes a SHA-256 hash of any file (image, key, binary) into derived key material via XOR as a physical second factor. |
| 🔑 Automatic v1 / v2 / v3 Compatibility | Sniffs the container header (ZV3\0, ZV2\0, or legacy v1) from the first 57 bytes to transparently decrypt all vault generations. |
| 📁 Dual File & Full Directory Support | Select individual files, multi-file selections, or complete directory trees using "Browse Folder" or "Browse Files". |
| ⚡ Native File System Access API | Uses window.showDirectoryPicker() with recursive folder hierarchy capture and seamless fallback to HTML5 webkitdirectory. |
| 📂 Instant Decrypted Vault Explorer (< 100 ms) | Reads only the 57-byte header and encrypted tail manifest in < 100 ms without buffering the vault. Caches pre-derived ephemeral CryptoKey in memory to unlock single-file extractions in < 15 ms without repeating 600,000 PBKDF2 rounds. |
| 🖼️ In-Vault Image Lightbox Viewer | High-res image preview modal with smooth 25%–500% zoom scaling, mouse drag-to-pan, wheel zoom, double-click zoom toggle, 90° rotation, pixel resolution badge, and seamless prev/next image navigation. |
| 📄 In-Vault Code & Text Document Viewer | Developer-friendly code viewer featuring numbered line gutters, monospace syntax formatting, word wrap toggle, memory-bounded preview safety (up to 5 MB), and 1-tap clipboard copying. |
| 🛡️ Zero-Knowledge Session Zeroization | Securely zeroes raw keyfile byte arrays with .fill(0) on vault close, lock, or tab unload. Completely nullifies session keys, chunk caches, and media/image blobs in volatile RAM, and scrubs password inputs from the DOM. |
| ⬇️ Multi-Tier Mobile & Desktop Streaming Saves | Routes 5 GB downloads via Tier 1 FileSystem Access API, Tier 2 Service Worker /_stream_download stream intercept, and Tier 3 OPFS staging. |
| 🎬 In-Browser Cinema Media Player | Direct playback for decrypted video (.mp4, .mov, .webm, .mkv) and audio (.mp3, .wav, .ogg, .flac, .aac) with zero disk writes. |
| 🎛️ Advanced Cinema Controls & Deck | Dedicated volume slider, mute toggle, variable speed (0.5×–2.0×), ±10s scrubbing, track navigation, PiP, fullscreen, static DOM preservation, media loading spinner, and comprehensive keyboard shortcuts (Space, ←/→, ↑/↓, M, F, P, Esc). |
| 📦 Smart Adaptive Compression | Instant STORE mode for pre-compressed media/archives + streaming DEFLATE for compressible documents/code. |
| 🤖 Dedicated Native Android App | Companion Android application (zevbuild/app-zevsafe) in Kotlin & Jetpack Compose with bit-identical v3 streaming encryption, AndroidX Media3 Cinema player, and background ForegroundService. |
| 💻 1-Click PC Setup (25+ GB) | Includes Windows batch launchers (Encrypt-Vault.bat, Decrypt-Vault.bat) and streaming PowerShell scripts for zero-RAM 25 GB–100 GB+ datasets. |
| 📊 Real-Time Telemetry HUD & Pipeline Tracker | Visual progress pills (Compress → Encrypt/Decrypt → Save) with live EMA-smoothed throughput (MB/s), active worker thread count badge, live countdown ETA, and an instant operation cancellation controller. |
| 🌐 Universal Auto-Hiding Header & Logo | Auto-hides sticky navbar and logo on downward scroll across all desktop, tablet, and mobile browsers with 60 FPS hardware-accelerated transitions to maximize screen workspace. |
| 🔔 Non-Blocking Glassmorphic Toasts | Replaces all intrusive browser alerts with smooth, dark-glass toast notifications and animated inline field shakes (@keyframes fieldShake) on validation failures. |
| 📐 Symmetrical Above-The-Fold Layout | Optimized vertical shell spacing and CSS Grid stretch alignment with bottom-anchored CTA action buttons for seamless laptop drop-zone visibility. |
| ⚡ Optimized WebP & Compressed Assets | All brand icons, OG social images, and logos compressed in-place (57%+ payload reduction) with next-gen WebP support for high-speed loading. |
| 📲 Installable Offline PWA | Progressive Web App with Cache-First Service Worker (v36), floating non-intrusive install banner, auto-updating in background, fully functional offline. |
| 📜 Interactive Changelog Portal | Dedicated in-app and web release notes page (change-log/) with live filtering and search across all releases. |
[Files / Directory Tree]
│
▼
Packaging & Granular Smart Compression
├── Pre-compressed Media / Archives (.mp4, .jpg, .zip, etc.) ──► STORE Mode (Instant 0-CPU)
└── Compressible Code & Docs (.txt, .json, .csv, .pdf, etc.) ──► Fast DEFLATE (Level 1)
│
▼
Generate Random Nonces: Salt (32 bytes) + IV (12 bytes) via window.crypto.getRandomValues()
│
▼
PBKDF2-SHA512 (Password, Salt, 600,000 iterations) ──► 256-bit Raw Key Bytes
│
▼ (Optional Keyfile 2FA)
SHA-256(Keyfile) XOR RawKeyBytes ──► Hardened Key Material
│
▼
Import as AES-256-GCM CryptoKey
│
▼
AES-256-GCM Encrypt(ZipBytes, Key, IV) ──► Ciphertext + 128-bit Authentication Tag
│
▼
Assemble Single Portable Vault (.zev):
┌──────────────┬──────────────┬───────────┬──────────────────┬────────────────┬──────────────────────────────┐
│ Magic 'ZV2\0'│ Version 0x02 │ Flags (1) │ Salt (32 Bytes) │ IV (12 Bytes) │ Ciphertext + GCM Auth Tag │
│ 4 Bytes │ 1 Byte │ (0x01=Key)│ │ │ (Variable Length) │
└──────────────┴──────────────┴───────────┴──────────────────┴────────────────┴──────────────────────────────┘
0 4 5 6 38 50
[Directory Tree]
│
▼
In-Memory ZIP Packaging
│
▼
Generate: Salt (16 bytes) + IV (12 bytes) via CSPRNG
│
▼
PBKDF2-SHA256 (Password, Salt, 100,000 iterations) ──► 256-bit AES-GCM Key
│
▼
AES-256-GCM Encrypt ──► Ciphertext + 128-bit Authentication Tag
│
▼
Output File (.zev):
┌──────────────────────────────┬──────────────────────────────┬────────────────────────────────────────┐
│ Salt (16 Bytes) │ IV (12 Bytes) │ Ciphertext + 128-bit GCM Auth Tag │
└──────────────────────────────┴──────────────────────────────┴────────────────────────────────────────┘
0 16 28
Automated Format Routing: When unlocking a vault, ZevSafe inspects the first 4 bytes. If the header matches
ZV2\0, it automatically executes the v2 pipeline and alerts the user if a keyfile is required (Flags & 0x01). If no magic header is present, it transparently decrypts the file using the v1 legacy pipeline.
| Parameter | v2 Standard (Default) | v1 Legacy (Compatibility) |
|---|---|---|
| Cipher | AES-256-GCM (Galois/Counter Mode) | AES-256-GCM |
| Key Size | 256 bits | 256 bits |
| IV / Nonce Size | 96 bits (12 bytes, unique per encryption) | 96 bits (12 bytes, unique per encryption) |
| Salt Size | 256 bits (32 bytes cryptographically random) | 128 bits (16 bytes cryptographically random) |
| KDF Algorithm | PBKDF2-SHA512 | PBKDF2-SHA256 |
| KDF Iterations | 600,000 rounds (OWASP 2024+ benchmark) | 100,000 rounds |
| Second Factor (2FA) | Optional physical Keyfile (SHA-256 XOR-mixed) |
Not supported in v1 |
| Tamper Protection | 128-bit GCM Authentication Tag | 128-bit GCM Authentication Tag |
| Header Identifier | 4-byte magic sequence: 0x5A 0x56 0x32 0x00 (ZV2\0) |
Raw header [ Salt(16) | IV(12) ] |
| Random Entropy | Native window.crypto.getRandomValues() |
Native window.crypto.getRandomValues() |
Tamper Resistance: AES-GCM is an Authenticated Encryption with Associated Data (AEAD) scheme. Any modification, bit-flip, or corruption of the encrypted file causes authentication to fail immediately during decryption, preventing silent data degradation or malicious injection.
- Open ZevSafe in any modern web browser.
- Provide your data using either method:
- Click 📁 Browse Folder to select a full folder tree (powered by native OS directory picker).
- Click 📄 Browse Files to select loose files or multiple documents.
- Or drag and drop files or a directory directly into the drop zone.
- Enter a strong password or PIN (minimum 4 characters) and confirm it.
- (Optional) Click Select Keyfile to bind a physical file (photo, document, random file) as an indispensable second factor.
- Click Encrypt & Download:
- The 3-stage tracker shows compression and encryption progress in real time.
- Your encrypted vault (
yourfolder.zev) automatically downloads.
- The Save Vault Password dialog opens:
- Click 📋 Copy to copy your password.
- Click 💾 Save Password to save credentials directly to your browser's password manager.
- Click ⬇️ Download Sheet or 🖨️ Print Sheet to generate an offline, printable recovery sheet (
<folder>_password_recovery_sheet.txt).
- Drag and drop your
.zevvault file into the Unlock a Vault panel (or click "Select .zev File"). - ZevSafe reads the header:
- If the vault was encrypted with a keyfile, a prompt asks you to select your keyfile.
- If it is a standard password-only vault, proceed directly.
- Enter your password and click Decrypt & Download.
- The Decrypted Vault Explorer modal opens immediately.
The temporary in-memory explorer lets you interact with decrypted files without writing unencrypted archives to disk:
- Play Media: Click
▶️ Play on any video or audio file to launch the cinema player. - Single File Download: Click ⬇️ Save on any row to download that specific file.
- Search & Filter: Filter by filename via the instant search bar, or switch category tabs (Videos, Audio, Photos, Docs, Code, Archives).
- View Toggle & Sorting: Switch between List and Grid layout, and sort by Name, Size, or File Type.
- Batch Download: Select multiple files using checkboxes and click ⬇️ Download Selected.
- Download Everything: Click ⬇️ Download All (ZIP) in the header to export the entire folder as a single ZIP archive.
When viewing decrypted media, use the full-featured cinema player:
- Playback Speed: Select speeds from
0.5×to2.0×. - Seek: Jump ±10 seconds with dedicated buttons or arrow keys.
- Playlist: Auto-detects all audio/video tracks in the vault; skip with ⏮️ Prev / ⏭️ Next.
- Picture-in-Picture & Fullscreen: Multi-task or watch in full display mode.
- New Tab Stream: Click
↗️ New Tab to stream the decrypted media in an isolated browser window.
| Key | Action |
|---|---|
| Space | Play / Pause |
| ← / → | Rewind 10s / Forward 10s |
| ↑ / ↓ | Volume Up / Volume Down (5%) |
| Shift + ← / → | Previous Track / Next Track |
| F | Toggle Fullscreen |
| P | Toggle Picture-in-Picture (PiP) |
| M | Mute / Unmute |
| Esc | Close Media Player |
Because ZevSafe performs all compression, key derivation, and cryptographic transforms in client memory, processing limits depend on available browser RAM:
| Platform / Device | In-Browser Safe Capacity | Recommended Tool |
|---|---|---|
| Desktop (Chrome, Edge, Firefox, Brave) | Up to ~5 GB+ | In-Browser Web App (Zero-Copy Architecture) |
| Mobile (Android Chrome, iOS Safari) | Up to ~2.5 GB | In-Browser Web App / PWA |
| Android Dedicated Native App | Multi-GB (Bounded Heap < 150 MB) | Native Android APK |
| Large Datasets (25 GB – 100 GB+) | Unlimited (Zero-RAM Streaming) | 1-Click PC Setup (Encrypt-Vault.bat / PowerShell) |
For massive datasets that exceed browser JavaScript heap allocations:
- Click 💻 PC Setup (25+ GB) in the navigation bar to download the pre-configured Windows toolkit.
- Drag and drop any folder onto
Encrypt-Vault.bat(or drag a.zevfile ontoDecrypt-Vault.bat). - The PowerShell streaming engine (
encrypt.ps1/decrypt.ps1) processes data chunk-by-chunk with zero RAM footprint, matching the exact v2 standard format.
For Android users requiring background encryption, system file manager associations, and native hardware media playback, ZevSafe provides an official native Kotlin Android application:
- 📦 Releases & APK Downloads: https://github.com/zevbuild/app-zevsafe/releases/latest
- Release APK:
ZevSafe-release.apk - Debug APK:
ZevSafe-debug.apk
- Release APK:
- 🔒 100% Zero-Knowledge & Client-Side: No internet permissions requested, zero network analytics, and zero plaintext file caching on disk during playback.
- ⚡ Full
ZV3\0STREAM AEAD Compatibility: Interoperates with vaults created in the browser or via desktop PowerShell toolkits. - 🎬 ExoPlayer Cinema Media Player: In-app streaming playback for multi-GB encrypted video and audio directly through AndroidX Media3 without temporary disk extraction.
- ⚙️ Persistent Background ForegroundService: Lock multi-GB archives in the background with persistent notification progress, live speed telemetry, and wake-lock protection.
- 📲 System Share Sheet & File Integration: Open
.zevfiles directly from any file manager (ACTION_VIEW) or encrypt files/folders straight from Android's share menu (ACTION_SEND).
ZevSafe is a certified Progressive Web App. Install it once to use it as an offline desktop or mobile application:
- Navigate to zevsafe.pages.dev.
- Click the Install icon (➕ or computer display) in the URL address bar, or click Install on the bottom banner.
- Launch ZevSafe directly from your Start Menu, Taskbar, or Applications launcher.
- Open zevsafe.pages.dev.
- Tap the "Install ZevSafe" banner at the bottom of the screen (or tap menu
⋮→ Add to Home screen). - Open ZevSafe from your home screen like a native Android app.
- Open zevsafe.pages.dev in Safari.
- Tap the Share button (box with upward arrow
⎋). - Scroll down and select "Add to Home Screen".
- Tap Add in the top-right corner.
✈️ Airplane Mode Verified: You can disconnect Wi-Fi and mobile data completely. The Service Worker serves all assets from cache, and Web Crypto runs locally.
zevsafe/
├── index.html # Main portal UI (Encrypt, Decrypt, Explorer, Media Player)
├── how-to-use-zevsafe/
│ └── index.html # In-depth technical documentation & user guide
├── change-log/
│ └── index.html # Interactive release history and changelog portal
├── js/ # Modular streaming engine & Web Worker pipeline
│ ├── crypto-worker.js # Off-thread PBKDF2-SHA512, deflate compression, AES-GCM
│ ├── stream-crypto.js # v3 STREAM AEAD cryptographic primitives
│ ├── stream-packer.js # Streaming ZIP64 packager with 24B Data Descriptors
│ ├── stream-saver.js # 4-tier download engine (FSA, SW, OPFS, memory fallback)
│ ├── stream-unpacker.js # Tail-manifest reader & selective chunk range extractor
│ └── worker-bridge.js # Zero-copy Transferable buffer bridge with backpressure
├── docs/ # Internal architecture, design specs, and test documentation
│ ├── README.md # Documentation directory index
│ ├── ARCHITECTURE.md # 5 GB streaming architecture specification
│ ├── WEB_APP_DESIGN.md # Web application design and cryptographic details
│ ├── TEST_INFRA.md # E2E test infrastructure specification
│ ├── TEST_READY.md # Test suite readiness report
│ ├── ORIGINAL_REQUEST.md # Milestone 5 requirements and memory bounds
│ └── task.md # Development roadmap and historical task tracker
├── tools/ # Windows PC 1-click zero-RAM streaming tools (25GB - 100GB+)
│ ├── README.md # Tools usage guide
│ ├── Encrypt-Vault.bat # 1-click drag-and-drop batch folder encryptor
│ ├── Decrypt-Vault.bat # 1-click drag-and-drop batch vault decryptor
│ ├── encrypt.ps1 # Streaming PowerShell encryption script
│ └── decrypt.ps1 # Streaming PowerShell decryption script
├── test/ # Automated regression, unit, and integration test suites
│ ├── test-android-encryption.js # Mobile browser OPFS & memory regression tests
│ ├── test-integration-m5.js # Milestone 5 streaming pipeline integration tests
│ └── ... # E2E test runners and synthetic streaming mocks
├── app.js # Main UI controller: state, drag & drop, Explorer, player
├── styles.css # Glassmorphic responsive styling, cinema player, dark theme
├── sw.js # PWA Service Worker (Cache-First & synthetic download route)
├── manifest.json # Web App Manifest for standalone desktop/mobile installation
├── assets/ # Brand logos, PWA launcher icons & vector assets
│ ├── README.md # Asset specifications & dimensions reference
│ ├── icon-192.png / .webp # PWA launcher icons (192×192)
│ ├── icon-512.png / .webp # PWA launcher icons (512×512)
│ ├── zevsafe-logo.png / .webp # High-res 3D metallic lock-shield brand assets
│ ├── zevsafe-og.png / .webp # Open Graph social preview banners (1200×630)
│ └── favicon.svg # Vector brand favicon (minified)
├── favicon.svg # Root fallback vector brand favicon
├── jszip.min.js # Local offline JSZip library for folder archive packaging
├── robots.txt / sitemap.xml # Search engine discovery and indexing rules
├── CHANGELOG.md # Release history and milestone documentation
├── PROJECT_MEMORY.md # Cross-platform Project Memory knowledge base
└── archive/
└── android-native-planning/ # Historical planning docs
ZevSafe requires no build step, no npm packages, and no node_modules. It is built with vanilla HTML5, CSS3, and modern JavaScript.
Clone the repository and open index.html directly in your browser:
git clone https://github.com/zevbuild/zevsafe.git
cd zevsafe
# Open directly:
start index.html # Windows
open index.html # macOS
xdg-open index.html # LinuxTo test PWA installation, Service Worker caching, and full offline synchronization, serve over localhost:
# Using Python 3:
python -m http.server 8080
# Or using Node:
npx serve .Then visit http://localhost:8080 in your web browser.
- Passphrase Sovereignty: ZevSafe enforces a zero-knowledge architecture. There is no password recovery mechanism, reset link, or administrative backdoor. If you lose your password or keyfile, your encrypted vault is mathematically unrecoverable.
- Keyfile Protection: When keyfile 2FA is enabled, the keyfile is combined with your password via SHA-256 XOR mixing. Always store your keyfile on a separate physical medium from your
.zevvault. - Volatile Memory Only: Decrypted files exist strictly in volatile browser RAM. Nothing is written to IndexedDB, LocalStorage, or disk unless you explicitly click a download or save button.
- Cache Isolation: The Service Worker (
sw.js) explicitly excludes.zevfiles and temporaryblob:URLs from cache storage, ensuring decrypted data can never be persisted in browser cache. - Air-Gapped Operation: All encryption operations take place on the local CPU via the browser's native C++ Web Crypto implementation. No telemetry, analytics, or external API calls are made.
Created by zevbuild — dedicated to developing privacy-centric, zero-knowledge, and offline-first open source tools.
Documentation & Guide: how-to-use-zevsafe/
Changelog & Updates: change-log/
Live Portal: https://zevsafe.pages.dev
This project is licensed under the MIT License — free to use, modify, audit, and distribute.
ZevSafe — Secure your data. Trust no one. Not even us.