Lain's Vault: Encrypted Workspace
A secure, multi-user desktop vault for encrypted file management and native Markdown editing. Files and folders are encrypted with AES-256 (CBC mode) behind a double-key system — down to their very file names.
Tech stack
- Languages
- Frameworks & libraries
Performance & metrics
- O(1) memory footprint during deep folder batch processing
- High-throughput block cipher execution
- Zero-overhead native file encryption via Rust
- Memory-safe execution without Electron's bloat
Why I built it
Standard file hiding or basic password protection is trivial to bypass, and even when contents are encrypted, file names often leak sensitive context. Meanwhile, typical note-taking apps store data in plaintext or sync it to unverified clouds. I built Lain's Vault as a fully local, multi-user vault where sensitive Markdown documents and external files are strictly encrypted, bound to specific user workspaces, and obfuscated down to their metadata — providing true deniability.
Architecture & decisions
The vault brings together two implementations from the same repository. The encryption engine, written in C# (.NET 6), uses the System.Security.Cryptography namespace to implement AES-256 in CBC (Cipher Block Chaining) mode and is designed to process massive directories in batches without memory leaks. The desktop application uses a Tauri (Rust) backend for direct, memory-safe file-system I/O and AES encryption, completely decoupled from the React frontend. A double-key cryptographic system ensures that file streams — both Markdown and external binaries — are encrypted continuously without corrupting the original payloads.
Key features
- 01Multi-user, isolated encrypted workspaces
- 02Military-grade AES-256 CBC encryption with a double-key system
- 03Complete file and directory name obfuscation
- 04Native, secure Markdown viewing and editing
- 05Automatic file-system level payload encryption
- 06Batch processing for deep folder structures
- 07No background services (runs entirely standalone)