Only you hold the key.
Vault is end-to-end encrypted cloud storage inside Dosya. Your device encrypts file contents, names and folders before upload. You control who can decrypt them.
Included free with your dosya.dev account.
- Argon2id + OPRF
- XChaCha20-Poly1305
- HPKE X25519
- Ed25519
What is a Vault?
A Vault is a private, end-to-end encrypted space inside your account. Everything you put in it is scrambled on your device before it is uploaded.
A normal folder
Encrypted at rest with service-managed keys. To power previews, search, thumbnails and sharing, Dosya can access the file itself along with details like its name, size and upload region.
A Vault
File contents, names and folders are encrypted on your device. You unlock your encryption keys with a separate Vault passphrase or recovery key. Access belongs to you and the people you add to an encrypted Space.
Your data, sealed before it leaves you
- 1
You choose a Vault passphrase
It is separate from your login password, and it never leaves your device. We never receive it and we cannot reset it.
- 2
Your device turns it into strong keys
Your device combines a server-assisted hardening step with Argon2id to derive a key that protects your encryption identity. The server processes a blinded value, without receiving the passphrase. Choose a strong, unique passphrase.
- 3
Files are encrypted before they upload
Every file gets its own key. File names and folder structure are encrypted too. We store ciphertext plus operational metadata, such as sizes and Space membership.
- 4
Sharing stays private
You share through encrypted Space membership. Your device seals the Space key to each recipient’s encryption identity. Recipients need a Dosya account with Vault set up; an ordinary public link does not unlock these files.
- 5
You get a one-time recovery key
At setup you see a recovery key once. Save it in a password manager or offline, outside Vault. It can unlock the same encryption identity if you forget your passphrase. Dosya cannot regenerate it for you.
Built so we cannot look inside
Encrypted on your device
Encryption and decryption happen on your device. Vault uploads send encrypted file contents.
Names hidden too
File names and folder structure are encrypted, not just the contents.
Hardened passphrase
Argon2id and a server-assisted OPRF strengthen passphrase protection. The threat model below explains its limits.
A key for every file
Each file is locked with its own key, so exposure of one never unlocks the rest.
Private sharing
Share to a teammate and the key is sealed to them alone. We never hold a usable copy.
Your keys, your control
Your passphrase and usable private keys stay on your device. Save the recovery key and keep an independent file backup.
Normal storage vs Vault
Choose ordinary storage for broad compatibility, or Vault when you need control of decryption keys.
| Feature | Normal folder | Vault |
|---|---|---|
| Where encryption happens | On our servers, at rest | On your device, end to end |
| Who can read the contents | You and dosya's systems | You and authorized Space members |
| File and folder names | Visible to dosya | Encrypted |
| Previews, search, thumbnails | Yes, server powered | Local decryption; preview support varies by client. No server-side content search. |
| Lost access | Standard password reset | Use your saved recovery key; preserve any still-unlocked trusted session |
| Who manages decryption keys | Dosya’s service | Your unlocked clients and authorized members |
| Sharing | Links and team permissions | Encrypted Space membership; no ordinary public-link unlock |
Vault trades convenience features like server-side search and password reset for privacy that only you control.
Use Vault on your devices
The web, desktop and mobile clients have Vault workflows. Choose the client for the task you need; ordinary storage features do not automatically carry over.
| Client | What you can do | Before you start |
|---|---|---|
| Web | Set up and unlock Vault, browse Spaces and existing folders, upload individual files, and download decrypted copies. | Folder-tree import is not supported. Web file guide |
| Desktop | Unlock Spaces, upload individual files, save decrypted copies and manage Space members. | Folder drops do not import nested contents. Uploads buffer each file in memory, so test large files on your computer. Desktop upload guide |
| Mobile | Unlock and browse Spaces, upload files or media, create folders, and preview supported images and videos after local decryption. | Other formats use a file card. Save and Share send a decrypted copy outside Vault. Mobile file guide |
These are the documented client workflows, not a promise that every older build supports them. If desktop recovery reports that it is unavailable in your version, update the app and follow the desktop unlock guide.
Save your recovery key. Then check it.
Your account password gets you into Dosya. Your Vault passphrase or recovery key unlocks your encryption identity. An account password reset does not decrypt Vault.
- Set up Vault and save the key outside it. Use a password manager or an offline record. Never send the real key to support or include it in a screenshot. Follow the setup guide.
- Start with a small, non-sensitive file. Keep its original. Upload it to an encrypted Space and confirm you can download and open it.
- Try recovery from another trusted session. Keep your original unlocked session open. Sign in on another trusted browser or device, open Vault, select Use recovery key, enter the full key and unlock.
- Open the same file. Confirm its contents match the original. Reaching the unlocked screen alone does not prove file access. Recovery unlocks the existing identity; it does not automatically set a new passphrase or restore revoked Space membership.
If you have already lost access
Keep any trusted device with an unlocked Vault session open and save essential files from it. Look for your stored key and check whether another authorized member can still access a shared Space. Destroying your Vault identity is not recovery: a replacement identity has different keys and does not restore access to the old files.
Follow the Vault recovery guideBefore you move important files
Can I share Vault files with a public link?
Vault sharing uses encrypted Space membership. The recipient needs a Dosya account and an encryption identity. An ordinary share link, even with a password, does not unlock a Vault file. For client delivery through a public link, use ordinary file sharing. Downloading a Vault file and sharing that copy puts plaintext outside Vault.
Can WebDAV, S3 or rclone open my Vault?
Dosya’s ordinary WebDAV, S3 and rclone connections do not perform the Vault unlock and Space-key flow. Use a Dosya Vault client for encrypted Spaces. An API key or a mounted drive does not replace your Vault keys. See the WebDAV guide for ordinary workspace files.
Will previews and search work like ordinary storage?
Vault does not offer server-side content search or server-generated plaintext previews. A client must decrypt a file locally to display it. Mobile supports image and video previews; other formats use its Save or Share actions. Check the client table above before choosing Vault for a preview-heavy workflow.
Does removing a member take back their downloaded copies?
No. Removing access cannot recall files or keys already copied by that person. Share a Space only with people you trust. The Space member guide explains adding members and completing removal.
Does Vault replace my backup or device security?
No. Keep an independent backup of irreplaceable files and test that you can open it. Encryption does not prevent accidental deletion or protect files from someone using an unlocked device. Lock Vault when you finish; copies saved to your device or shared with another app need their own protection.
Is Vault included in my plan?
Vault is included with every Dosya account. Its stored bytes count toward the owning workspace’s available storage; encryption does not provide a separate unlimited allowance. Compare storage plans.
The design, in engineering terms
For full transparency, here is how Vault actually works. The server is treated as an untrusted sequencer: all key derivation, encryption and decryption run client side on your device. The implementation uses libsodium, HPKE libraries and a VOPRF library. The server stores encrypted private-key bundles and file data, routes requests, and enforces membership. Use of these libraries is not an audit of Vault.
Key hierarchy
| Layer | What it is | Comes from | What it protects |
|---|---|---|---|
| 1. Passphrase | Your secret, chosen by you | You | Protects the passphrase-wrapped identity. Never sent to us |
| 2. Hardening (OPRF) | A server assisted strengthening step | Your passphrase plus our OPRF key | Adds a server secret to passphrase hardening; database-only protection depends on that secret staying separate |
| 3. Key encryption key | A derived master key | Argon2id over the hardened passphrase | Wraps your identity keys |
| 4. Identity keys | An X25519 and Ed25519 key pair | Generated on device, wrapped by the key encryption key | Receiving sealed keys and signing your actions |
| 5. Recovery key | A high-entropy key shown once at setup | Generated on device, you save it | A second way to unlock your identity keys |
| 6. Space key | One key per encrypted Space | Random, shared to members via HPKE | The folder index and every file key inside it |
| 7. File key | One key per file | Random, wrapped by the Space key | That file's encrypted data chunks |
Cryptographic primitives
What the server can and cannot see
Can see
- Encrypted chunks and their sizes
- Upload and download timing and frequency
- Which accounts belong to a Space (the membership graph)
- Your IP address and device metadata
- Opaque identifiers linking chunks to a Space
Cannot see
- File contents
- File and folder names
- Folder structure beyond an encrypted index
- Your passphrase, recovery key, or any private key
- The plaintext of anything you share
Threat model and honest limits
Designed to protect stored contents. A database and object-storage copy contains encrypted data, not usable private keys. The OPRF protection against offline passphrase guessing depends on its server secret remaining separate from that copy. A compromised device, stolen recovery key or compromised client code is a different threat.
Web delivery is the trust boundary. Your browser downloads the app code from us on each visit, so in principle a compromised server could serve modified code. This is inherent to all in-browser end-to-end encryption. Installed clients have their own distribution and update trust boundaries. The Vault help guides describe supported actions for each client; installation does not remove the need to trust the code and its updates.
Independent audit status. Vault has not yet completed an independent cryptographic audit. Its design uses public specifications including RFC 9180 (HPKE) and RFC 9497 (VOPRF). Standard primitives and local tests do not establish the security of the complete product.
Metadata is not hidden. The server sees encrypted sizes, timing, membership and request metadata. A network observer may infer traffic sizes and timing; HTTPS does not expose Space membership in plaintext to every observer.
Support cannot bypass encryption. If you lose your passphrase and recovery key, preserve any still-unlocked trusted session. Other authorized members may retain access to shared Spaces. Without a usable key or an accessible decrypted copy, Dosya cannot recover your private files.
Ready to lock it down?
Create a Vault in your account and start encrypting. Included free with every plan.
Save your recovery key before entrusting important files to Vault.