Drag a file in. Enter a passphrase. Get an encrypted .vx2 file.
Your original is never modified. Nothing leaves your machine.
AES-256-GCM-SIV (RFC 8452) stays secure even if nonce reuse happens. Per-chunk authentication tags catch any tampering.
Argon2id at 256 MiB / 3 iterations / 4 lanes. GPU and ASIC resistant. Offline brute-force becomes prohibitively expensive.
Files of any size (up to 4 PiB) stream through 1 MiB chunks. Constant ~258 MB RAM whether you encrypt 1 KB or 1 TB.
V4 format authenticates the full header (magic, salt, nonce) as AAD on every chunk. Any tampering is detected at the AEAD layer.
Started encrypting the wrong file? Hit Cancel. The .tmp file is cleaned up and you're back to a clean state in under 50 ms.
Every key, plaintext buffer, and intermediate is wrapped in Zeroizing<T>. Secrets are wiped from RAM the moment they go out of scope.
Windows x64, macOS Universal, Linux x64, and Android 7.0+ (arm64, armv7, x86_64, x86). One Rust core, four platforms.
Output is written to a .tmp file first, then renamed on success. Kill the process, pull the plug — no partial or corrupted files.
Zero internet permissions. Zero storage permissions (uses Storage Access Framework). Your files never leave your device.
Latest release: v2.2.0. Verify the SHA-256 hash in the release notes after download.
cargo install --git https://gitlab.com/theredhacker0345/neuron-encrypt --bin neuron-encrypt-cli
Every algorithm is cited to its RFC. Every claim is backed by a public audit. No security through obscurity.
AES-256-GCM-SIV8452BE32, 1 MiB chunksArgon2id (256 MiB / 3 / 4)HKDF-SHA512OsRng (OS CSPRNG)VAULTX04 (AAD)No. There is no backdoor, no recovery key, no master password. If you forget the passphrase, the files are gone. This is by design — a backdoor that lets you in also lets an attacker in.
No. The passphrase is held in memory only long enough to derive the encryption key via Argon2id, then it's zeroed. It's never written to disk, never sent over the network, never logged.
V2 (VAULTX02) — legacy single-shot format, entire file in RAM, ≤1 GiB.
V3 (VAULTX03) — streaming format, 1 MiB chunks, no size limit, header NOT authenticated.
V4 (VAULTX04) — current default, same as V3 but with header authenticated as AAD on every chunk.
All three are readable by v2.1. New encryptions use V4. There is no auto-migration — re-encrypt to upgrade.
Code signing requires an Authenticode certificate ($200-400/year). This is an open-source project without a budget for that yet. Windows SmartScreen will warn on first install — click "Run anyway". Always verify the SHA-256 hash in the release notes against your download.
Neuron Encrypt is file-level (not volume-level like VeraCrypt, not cloud-file like Cryptomator). It uses AES-256-GCM-SIV (nonce-misuse resistant, unlike AES-XTS or AES-CBC), Argon2id (memory-hard, unlike PBKDF2), and authenticates the header (V4 AAD, unlike most tools). See the README for a detailed comparison table.
Yes — neuron-encrypt-cli ships with the desktop build. Supports piping (encrypt -i file.pdf -o - | ssh ...), JSON output for CI/CD, password files, and shell completions.
Do NOT open a public issue. Use the GitLab confidential issue to report privately. We'll acknowledge within 48 hours and work with you on a fix before public disclosure.
GPLv3 — Copyright (c) 2024–2026 Ubaid ur Rehman. See LICENSE for full text.
Download Neuron Encrypt and protect your files in under a minute.
Get Neuron Encrypt