Primary password
Argon2id derives a key-encryption key. A random master key—not your password—drives the payload and authentication keys.
Private by design · Local by default
Your files.
Sealed locally.
Cascade Vault turns files and folders into authenticated .cscd vaults—without an account, a cloud service, telemetry, or password recovery.
project-archive.cscdAuthenticated local vaultOffline-first, literally
Your files never need to leave your machine.
Cascade Vault has no runtime networking, no sign-in, no telemetry, no analytics, and no remote fonts. Encryption and extraction happen locally.
You keep the vault. You keep the passwords. If both are lost, there is no recovery service waiting behind the scenes.
One format. Deliberate layers.
Authenticated before anything is opened.
Three-cipher cascade
AES-256-CBC, Twofish-256-CBC, then Serpent-256-CBC, with independent derived keys and IVs.
Full-container authentication
HMAC-SHA-256 covers the exact header and all ciphertext and is checked before payload decryption.
Desktop, not a service
Built for Windows.
Designed for macOS.
Windows 10 and 11 development builds are available for x64 and ARM64. macOS 14+ x64 and ARM64 targets are cross-built, but physical-Mac runtime validation, signing, and notarization remain open release gates.
See exactly what is ready →Honest by default
What it does not promise.
- No protection from malware or keyloggers on an unlocked device.
- No password recovery, secure-erasure guarantee, or cloud backup.
- No claim of unbreakability, quantum resistance, or “768-bit security.”
- No FIPS validation or formal independent cryptographic audit.