NEXUS-Q Vault

Protect your files. Without leaving your device.
A local-first desktop vault for encrypting files and folders, with separately encrypted recovery backups.

Website · Downloads · Cryptographic engine · Security policy

Early access — alpha software. This project has not received an independent security audit. Do not use it as the only copy of important data or as the sole protection for high-value information. Read the security limitations before use.

NEXUS-Q Vault is an open-source desktop application for protecting local files. It is designed around a simple idea: encryption and vault data should stay on the computer you control, without requiring a cloud account or a hosted service.

At a glance

• Local-first: vaults, encrypted files and backups are stored at locations you choose.
• File encryption: encrypt individual files into .nqx sidecar files and restore them to a new destination.
• Folder encryption: protect a folder using an authenticated encrypted manifest and opaque object names; original paths are inside the encrypted manifest.
• Recovery backup: export an encrypted .nqb backup of vault/key state and restore it into a new vault with new credentials.
• No automatic source deletion: original files are kept; encryption does not silently remove them.
• One cryptographic boundary: cryptographic operations are delegated to the Rust nexusq-core engine.
• Desktop experience: Tauri 2 interface for Linux, Windows and macOS, with light/dark themes and English/Spanish UI.

Screenshots

Overview

Create or open a vault

Encrypt and restore files and folders

Settings and local profile

How it works

1. Create a vault at a location you choose and set a strong vault password.
2. Unlock the vault when you want to use its file-protection operations.
3. Encrypt files or folders. The app writes encrypted output separately and leaves source files untouched.
4. Create a recovery backup using a separate backup passphrase. Keep it somewhere safe and separate from the vault.
5. Restore when needed. Import the backup into a new vault with a new vault password.

Important: keep all parts of your data

A .nqb recovery backup contains vault/key state. It does not include your individual .nqx encrypted files or the encrypted objects inside a folder vault. Keep those encrypted payloads separately, along with the backup. Losing either the payloads or the required credentials can make recovery impossible.

The backup passphrase is separate from the vault password. A backup restores vault/key state; it does not reveal or reset the original vault password.

Current capabilities

Area	Available in this alpha
Vault lifecycle	Create, open, unlock and lock a local vault
Individual files	Encrypt to .nqx; decrypt to a new destination
Folders	Encrypt to an authenticated manifest plus opaque encrypted objects; restore to a new destination
Recovery	Export/import an encrypted .nqb vault/key backup
Password UX	Password generator and show/hide controls
Desktop UI	Separate navigation pages, English/Spanish labels, light/dark mode
Data collection	No application telemetry is implemented

Security status and limitations

This is an early-access prototype, not a security-audited or production-hardened product. The repository publishes its threat model, security policy, and format/design notes, but public documentation is not a substitute for independent review.

Known limitations include:

• The app cannot protect plaintext while the vault is unlocked from malware, keyloggers, screen capture, a compromised user account or a compromised operating system.
• Original files are preserved. The app does not promise secure deletion of originals, temporary files, swap, snapshots, filesystem journals or SSD blocks.
• Folder-vault objects are currently limited to 32 MiB per file by the folder adapter. Large-file streaming is not implemented.
• Folder encryption rejects symbolic links, omits empty directories, accepts portable UTF-8 paths only, and rejects unsafe paths and case-insensitive path collisions. Object count, approximate encrypted sizes, timestamps and access patterns remain visible.
• Folder manifest format migration/upgrade behavior is not implemented yet.
• The .nqb backup does not bundle encrypted file payloads or folder-vault object directories; preserve them separately.
• Filesystem permission and durability guarantees vary by platform and still need broader validation.
• Recovery usability, accessibility, update security, signing/notarization, reproducible builds and independent security review remain incomplete.
• No FIPS validation, certification, independent audit or blanket “quantum-proof” claim is made.

See PRODUCT.md, THREAT_MODEL.md, SECURITY.md, folder format v1, and the streaming-format proposal for details.

Download

Pre-release installers are published on the GitHub Releases page.

Platform	Release artifact
Linux	.deb and .AppImage
Windows	.msi and .exe (NSIS installer)
macOS	.dmg

Only download builds from this repository's Releases page. Each release includes a SHA256SUMS.txt file for accidental-corruption checks (checksums are not digital signatures). Alpha builds may contain platform-specific issues. Code signing/notarization and independent artifact provenance are not yet provided; your operating system may show an installation warning.

On Linux, verify downloaded files with sha256sum -c SHA256SUMS.txt; on macOS use shasum -a 256 -c SHA256SUMS.txt. On Windows, compare certutil -hashfile <installer> SHA256 with the matching entry. A matching checksum detects accidental changes but does not authenticate who built the installer.

Build from source

Requirements

• Rust 1.90 or newer.
• The platform prerequisites for Tauri 2.
• A sibling checkout of the NEXUS-Q cryptographic engine at the exact revision used by this repository.

The desktop crate uses a local path dependency on ../nexus-q. From the Vault repository directory:

git clone https://github.com/lecodev-26/nexus-q.git ../nexus-q
git -C ../nexus-q checkout efe486603af266c379131526d8320a0584254ce4

cargo run --locked --manifest-path apps/desktop/Cargo.toml

Run the repository checks before submitting changes:

cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo fmt --manifest-path apps/desktop/Cargo.toml -- --check
cargo clippy --manifest-path apps/desktop/Cargo.toml --locked --all-targets -- -D warnings

To build installers locally, install the Tauri CLI 2 and run:

cargo install tauri-cli --version '^2.0.0' --locked
cd apps/desktop
cargo tauri build

The GitHub Actions release workflow builds platform-native installers on Linux, Windows and macOS when a version tag is pushed.

Architecture

• Desktop shell: Tauri 2.
• Application and filesystem boundary: Rust commands in apps/desktop/src/main.rs.
• User interface: HTML, CSS and JavaScript in apps/desktop/ui/.
• Cryptography: nexusq-core from the NEXUS-Q engine repository, pinned in CI/release builds to commit efe486603af266c379131526d8320a0584254ce4.
• Folder adapter: versioned authenticated manifest and opaque encrypted objects; see FOLDER_FORMAT_V1.md.

Vault does not implement a parallel cryptographic engine, custom key derivation or an independent encryption format.

Project documentation

• Product scope and MVP
• Threat model
• Security policy and vulnerability reporting
• Architecture decisions
• Folder vault format v1
• Recovery design
• Streaming format proposal
• Roadmap
• Contributing
• Code of conduct
• MIT license

Contributing

Issues and pull requests are welcome. Please read CONTRIBUTING.md first. Changes involving cryptography, key handling, recovery, file formats, backups, dependencies or release verification are security-sensitive and must include appropriate tests and threat-model updates.

License

NEXUS-Q Vault is released under the MIT License.