Lock it away. Keep the key.
The Vault is an encrypted place on your own computer for the files and notes that matter. It opens with a security key, your fingerprint, or a password.
Nothing is uploaded. There is no account to make.
Free update for existing users · New to VaultSort? $24.99 one-time, no subscription
VaultSort could already encrypt a file. What it did not have was somewhere to put it.
Encrypting files one at a time makes you the filing system. You have to remember which ones you locked, where you left them, and to lock the next one. A vault moves the decision up a level: things inside it are protected because of where they are.
One place to check
Instead of hunting for the files you encrypted last spring, you open one thing and everything sensitive is in it — files, folders, and notes together.
No per-file decisions
Anything you drop in is encrypted on the way in. There is no moment where you meant to protect something and forgot to.
Notes belong here too
Recovery phrases, licence keys, the account details someone would need in an emergency. Written in VaultSort, encrypted like everything else.
Opened with hardware you already carry.
A Vault can hold several unlock methods at once, and any single one opens it. Add a second before you need it — VaultSort asks you to, because a vault with one way in is a vault you can be locked out of.
A security key
A YubiKey or any FIDO2 key that supports the WebAuthn PRF extension. Touch the key and the Vault opens; the secret it derives never leaves the key.
Touch ID or Windows Hello
The authenticator already built into your machine, through the same WebAuthn path. Your fingerprint stays where it belongs — the Vault never sees it.
A password
Stretched with Argon2id, calibrated to your machine when you set it. For when you have no key on you and no reader in front of you.
A recovery code
Generated once, shown once, written down by you. It exists so that losing a key is an inconvenience rather than the end of your Vault.
Removing a method is allowed. Removing the last one is not — that refusal is in the format itself, not the interface.
What happens to a file on the way in.
Every file gets its own key. That is the part that makes the rest work — adding a password to a Vault you normally open with a YubiKey re-seals one small key, not a hundred gigabytes of files.
Its own key
A fresh 256-bit key is generated for the file and used to encrypt its contents with AES-256-GCM. Nothing else in the Vault shares it.
Sealed under the Vault
That per-file key is wrapped under the Vault’s own master key, which only exists in memory while the Vault is unlocked.
Written down first
The move is recorded in a journal before it happens, so an interruption leaves a file either in or out, never half-written.
The original, your call
Copy leaves it where it was. Move securely erases it afterwards, and reports the guarantee it could actually give on that disk.
It survives the battery going flat.
An encrypted store is only as good as its worst interruption. Close the lid mid-import, lose power, force-quit the app — the Vault has to come back whole, or it is not somewhere you should keep anything.
So every multi-step change is written to a journal before it is made, and the next unlock replays it: finishing what had committed, discarding what had not, and sweeping up anything left behind. A crash costs you the import you were doing, and nothing else.
Auto-locks when you leave
On sleep, on screen lock, and after an idle period you set. Waking the machine gets you the lock screen, not your files.
Keys wiped, not just dropped
When the Vault locks, its keys are overwritten in memory rather than left for the garbage collector to get around to.
Nothing sensitive in the logs
Not a file name, not a note title, not a path. The Vault logs error codes and counts — verified by a test that greps for them.
A second app cannot fight it
A running VaultSort task holds a lease on the Vault folder, so two of them can never write over each other.
A licence may decide what goes in. It never decides what comes out.
The Vault is a premium feature, so creating one and adding to one require a licence. Opening it, reading it, searching it, exporting from it, deleting from it and adding a new recovery code do not — and they are built so that they cannot.
This matters because a licence is a thing a program can be wrong about. You could be offline, on a new machine, or reinstalling. If any of that could stop you opening your own Vault, then it was never really yours. So the check simply is not on that path.
Creating a Vault. Importing files. Writing a note. Renaming things inside it.
Unlocking. Reading. Exporting. Deleting. Adding a recovery code so you are never locked out.
Get VaultSort.
One-time purchase. Lifetime license. No subscription.
Frequently asked questions
The things worth knowing before you put anything in it.
More questions?
Contact support →Give the important things somewhere to live.
On your disk. Opened with your key. Locked when you walk away. And never, under any circumstance, held hostage by a licence check.