Windows · Encryption
Encrypt a file
with your fingerprint.
BitLocker protects a drive that is switched off. It does nothing about the laptop that is already unlocked, the folder synced to OneDrive, or the archive you are about to email. Per-file encryption covers the gap, and Windows Hello means it costs you a fingerprint rather than another password.
VaultSort for Windows is in beta. Free to try, no account required.
What full-disk encryption does not cover
BitLocker stops protecting once you log in
Its threat model is a drive removed from a machine, and it handles that well. From the moment Windows is running and unlocked, every file on it is readable by anything with your session — including whatever you ran by mistake.
Cloud sync copies whatever it is given
A file in a OneDrive, Dropbox or Google Drive folder is uploaded as it exists on disk. Encrypt it first and the copy in the cloud is ciphertext; encrypt it afterwards and the earlier version may still be in the provider’s history.
Passwords are the weak part of most file encryption
A zip encrypted with a password you can remember is encrypted with a password that can be guessed. Offline attacks on archives are fast, well-tooled, and indifferent to how clever the password felt.
BitLocker is not on every edition
Windows Home ships Device Encryption on qualifying hardware, not full BitLocker with its management surface. Plenty of machines have neither, and the owner usually has no idea which case they are in.
How VaultSort encrypts on Windows
Windows Hello as the key
Your fingerprint, face or device PIN unlocks the file. The secret that protects it is held by the platform authenticator rather than derived from something you typed, so there is no password to guess offline.
AES-256-GCM, authenticated
Authenticated encryption, so a file that has been tampered with fails to open rather than decrypting into something subtly wrong. The full format is documented byte by byte in the security overview rather than summarised in marketing terms.
Hardware security keys too
A YubiKey or any FIDO2 key works alongside Windows Hello. Register several — one on the desk, one in a drawer, one somewhere else entirely — and any of them opens the file.
Multiple keys per file
The file key is wrapped once per registered credential, so adding a key later does not mean re-encrypting everything, and losing one key does not mean losing the file.
A recovery code, offered once
When you register your first key VaultSort offers a one-time recovery code. It goes in your password manager, and it is the way back in if every hardware key is ever lost.
Nothing leaves the machine
Encryption and decryption happen locally. There is no account, no key escrow and no upload — which also means nobody can unlock your files for you, including us.
What it does not do yet
- — Lose every registered key and the recovery code, and the file is unrecoverable. That is what hardware-bound encryption with no escrow means, and it is the trade you are making. Save the recovery code before you encrypt anything you care about.
- — A platform authenticator is bound to the machine that holds it: Windows Hello on this PC will not open a file on another one. Register a portable security key as well if the file needs to travel between machines — including between Windows and macOS.
- — Encrypting a file does not remove the plaintext that already existed on the disk. Use secure deletion on the original, and remember that OneDrive may still hold earlier versions in its own history.
- — Registering a key opens a browser tab briefly to complete the WebAuthn hand-off. That is expected, and the same mechanism on both platforms.
Questions people ask
Do I need a YubiKey, or is Windows Hello enough?
Windows Hello alone is enough to encrypt and decrypt on that machine. Add a portable security key if you need to open the file on another computer, or want a spare that is not tied to one device.
Can I open a file I encrypted on my Mac?
Yes, provided it was encrypted with a key you can present on Windows — a cross-platform security key rather than Touch ID. A platform authenticator stays with its machine by design, on both sides.
Is this the same as putting files in a password-protected zip?
No. A zip password is a secret you can type, and therefore a secret that can be attacked offline at speed. Here the key is held by hardware and never typed, which removes that class of attack entirely.
What happens if VaultSort disappears tomorrow?
The file format is published in the security overview in enough detail to implement a reader. That is a deliberate choice — encryption you cannot decrypt without one vendor still trading is a hostage situation, not a safeguard.
Try it on your own files
One purchase, no subscription. $24.99 once, and every feature is included.