Choose files and folders
Cascade Vault reviews the complete selection, checks readability and archive limits, and warns about portability, cloud folders, and actively changing data.
How it works
A local path in. A verified path out.
Cascade Vault treats encryption as a complete file operation—not just a cipher call. Selection review, authentication, staging, and final promotion all matter.
Choose a destination
Name one .cscd vault and select an output folder. Existing files are never silently overwritten.
Create strong secrets
A primary password is mandatory. Optional secondary protection assigns an independent password and random master key to the outer Serpent layer.
Archive, encrypt, authenticate
An uncompressed PAX stream is padded once, passed through AES, Twofish, and Serpent, and sealed with HMAC over the exact header and ciphertext.
Verify before publishing
The new vault is read back and authenticated. Complete SHA-256 content hashes from the archive are compared with the captured source bytes before the final file is promoted.
Unlock order
Trust is earned before plaintext exists.
- Validate the fixed container structure and bounded resource parameters.
- Use the primary password to unwrap the primary CMK.
- Derive the HMAC key and authenticate the exact header plus complete ciphertext.
- If enabled, use the secondary password to unwrap the secondary CMK.
- Decrypt Serpent, Twofish, then AES; for format 2.0 validate framing and authenticated size padding, decompress within limits, then validate PAX.
- Extract into private staging, verify, then promote without overwriting.
Original files
Removal stays off by default.
After verified success, you may separately choose Trash/Recycle Bin or normal filesystem deletion. Both require a second confirmation and neither is secure erasure. The safer default is to keep the source until you have tested the vault and your backup plan.
Plaintext recovery follows the same caution: an incomplete or unauthenticated extraction is never presented as a completed result.