FolksLock

Lock any file with a key

Turn any file into an encrypted .folks file. Only ZipFolks can open it, and only with the key we give you. We never store your file or your key.

Drop any file to lock, or browse

Any format · up to 100 MB · the result is a .folks file plus a key

How FolksLock works

1You upload a file

Any format, sent over HTTPS.

2ZipFolks makes a key

A new random 256-bit key K, plus a random salt and nonce.

3Derive the file key

HKDF-SHA256(K + server secret S, salt).

4Encrypt

AES-256-GCM in 64 KB authenticated chunks, file name inside.

5You get two things

The .folks file and key K. Both are wiped from server memory.

1You upload .folks + key

Over HTTPS, on ZipFolks only.

2Check the header

The file must come from this ZipFolks installation.

3Rebuild the file key

HKDF-SHA256(K + S, salt from the file).

4Decrypt and verify

Every chunk’s tag must match. A wrong key or any edit fails.

5Original file returned

Same name and extension. Nothing is kept.

Your key Kshown once, never stored

Server secret Snever leaves ZipFolks

HKDF-SHA256with per-file salt

File keyAES-256-GCM

Both halves are needed. K alone is useless outside ZipFolks, and ZipFolks can’t open a file without K.

Strong, standard encryption. AES-256-GCM authenticated encryption, with keys derived by HKDF-SHA256. These are the same building blocks used by TLS and modern password managers. FolksLock does not rely on a secret algorithm.
A fresh key for every file. Each file gets its own random 256-bit key, salt and nonce, so locking the same file twice gives two different results.
Two halves to every key. The file key is built from your key and a secret held only by this ZipFolks server. Your key alone can’t decrypt the file anywhere else. The server alone can’t decrypt it either, because it never keeps your key.
Tamper-evident. The file is encrypted in 64 KB chunks. Each chunk is bound to the header, its position and an end-of-file marker. Any change, reordering or truncation is detected, and the file is refused.
No back door. There is no master key or reset option. If the key is lost, nobody can recover the file, including us.

Anyone who has both the .folks file and its key can unlock it on ZipFolks. Treat the key like a password and send it separately from the file.
“Only ZipFolks can decrypt” holds as long as the server secret stays private. The operator must keep FOLKSLOCK_SECRET secret and backed up. If it is lost, existing .folks files can never be opened again.
Encryption happens on the server, so your file passes through server memory while it is being processed. Always use ZipFolks over HTTPS.

Nothing is stored. Files are processed in memory and returned straight away. Nothing is saved to disk or a database. Videos are the one exception: they use a temporary file while ffmpeg runs, which is deleted as soon as the download is sent.
Keys are never stored or logged. The key is returned once in the response and then wiped from memory.
Minimal statistics. If the operator turns on statistics, only file sizes, formats and timings are recorded. File names, contents and keys are never recorded.
No caching. Every response is sent with Cache-Control: no-store.