Features and specs

What Vault-ZIP does and how far it has been tested. Figures were measured on our own PC and will differ on yours.

Creating ZIP files

Encryption	AES-256 (WinZip AES). The key is derived from the password with PBKDF2, and every file carries a value (HMAC) that reveals tampering. The old ZipCrypto method is never used for writing.
Passwords	Generate one (length and character types set in the settings), use a preset one, type one each time, or none. The password is recorded in the ledger.
Checked after writing	The finished ZIP is read back in full to make sure every file comes out as it went in. Its SHA-256 is recorded too.
File names	Written as UTF-8 (with the UTF-8 flag) and normalised to NFC, so names from a Mac look the same on Windows.
Compress separately	Turns each selected file or folder into its own ZIP.
No overwriting	If the name is taken, " (2)" is added. An existing file is replaced only if you chose that in the settings.

Extracting

Formats	ZIP (Deflate, Deflate64, BZip2, LZMA, XZ, Zstandard, PPMd, the old PKZIP 1.x methods, AES-256, ZipCrypto), 7z (including encrypted headers), RAR (1.5 to 7, RAR5, encrypted, solid), tar and tar.gz/.bz2/.xz/.zst, single gz/bz2/xz/zst files, CAB, MSI, and self-extracting 7z, ZIP and RAR.
Recognition	By content, not extension. A file with the wrong extension still extracts.
External tools	ISO, LZH, ARJ, NSIS, Inno Setup and others are extracted by a tool such as 7-Zip, only if you enable it in the settings (off by default).
Ledger passwords	ZIP files made by Vault-ZIP open with the password recorded in the ledger.
Tampering	An AES-encrypted ZIP succeeds only when every file's HMAC matches; otherwise no partial file is left as if it were complete. A matching HMAC means the encrypted data has not changed; it does not prove who made the file.

File names

The aim: a ZIP made on any system extracts into the same folder structure on any system.

Old Japanese ZIP files: names written in Shift_JIS by older Windows tools are recognised and extracted with the right Japanese names, including characters whose second byte is \.
macOS names: decomposed (NFD) names are normalised to NFC.
macOS extra files: the __MACOSX folder and ._ files are left out (can be changed in the settings), and the number left out is reported.
Names Windows cannot hold: reserved names such as CON, names with ? or :, and trailing dots are replaced with usable names, and the result lists every change.
Invisible characters: characters that reverse text direction (used to disguise an extension, as in a name shown as invoiceexe.pdf that is really an .exe), zero-width characters and control characters become _ and are shown in a visible form such as \u{202E}.
Names that differ only in case: Windows treats them as one name, so one gets " (2)" and both are kept.

Hostile archives

Each of the following is stopped before or during extraction, or made harmless. Automated tests check every one on each build.

Names that would write outside the folder (../, absolute paths, drive letters): stopped before anything is written.
Symbolic links, junctions, devices and other special files: never created.
Archives that grow huge when extracted (ZIP bombs): Vault-ZIP counts the bytes it writes instead of trusting the headers.
More than 100,000 files: Vault-ZIP asks before going on.
Damaged files: 42,000 damaged RAR files, 300 damaged CAB files and fuzzing (large amounts of random input) cause no crash.
A full disk or a forced stop during extraction: no partial file is left under its final name, and the next start cleans up.

Password ledger

Storage	A database encrypted with SQLCipher (AES-256). Its key is kept in Windows Credential Manager. The portable version uses a passphrase you choose.
Contents	Names of the ZIP and PDF files, dates, passwords, notes and the list of original files.
Showing and copying	A password appears only when you press "Show", after an identity check such as Windows Hello. A copied password is kept out of the Windows clipboard history (Win+V) and cloud clipboard and is cleared after a while, unless you have copied something else meanwhile.
Screen captures	An option keeps a window showing a password out of screen sharing, recordings and screenshots (off by default; Windows 10 version 2004 or later).
Safeguards	Recovery key, encrypted backup export and import, automatic backups. A failed import leaves the current ledger and key untouched.
Across versions	A copy is made before the ledger format is upgraded. Data written by a newer version is not changed by an older one, which stops and says so.

PDF encryption

Method	AES-256 (the PDF 2.0 method, R6). An open password is added and recorded in the ledger.
Viewers tested	pdfium (the engine of Chrome, Edge and Android), pdf.js (Firefox's engine) and qpdf: they open the file with the right password, refuse a wrong one, and give the same Japanese text as the original.
Checked after writing	The encrypted PDF is read back and compared with the original.

What is this file?

Tells a file's type from its content, not its extension, and which apps usually open it. The file is never opened or run. About 0.1 ms per file (our PC, SSD). The result is an estimate, not a safety verdict.

Network

Vault-ZIP connects only when you ask it to. There is no automatic update check, no usage reporting, no licence check over the network and no account.

The Microsoft component that draws the windows (WebView2) can connect to Microsoft's servers on its own. Vault-ZIP creates every window with that background traffic switched off. In our measurement, nothing left the PC in the first 100 seconds after start.
Connections happen only when you click a guide link (your browser opens it), when you share a file with an app you pick, and when the installer fetches WebView2 on a PC that lacks it.
The Windows version contains no internet client component.

Compatibility with other tools

AES-256 ZIP files made by Vault-ZIP have been tested with:

Tool	Result
7-Zip 26.05	Opens with the password; at three compression levels every file is identical to the original (compared by SHA-256). Japanese names and nested folders are correct.
Windows 11 File Explorer	Asks for the password and extracts. Names in Japanese, with full-width brackets or emoji, and sizes are shown correctly.
Windows `tar.exe`	Extracts every file at the right size with the password.

The other way round, 7z files made by 7-Zip 26.05 (including encrypted headers), self-extracting files, ZIP files with various methods, and tar files extract in Vault-ZIP with every file identical to the original.

Tests with Lhaplus, CubeICE and other tools are still to come.

Performance

Measured on our PC (Ryzen 5 5600X, 32 GB of memory, an NVMe SSD and a 5,400 rpm hard disk). Compression time includes reading the ZIP back to check it.

Measured	Result
One 5 GB file (SSD, AES-256)	Compress about 116 MB/s, extract about 267 MB/s
Memory, one file up to 100 GB	About 13 MB, not growing with the size
100,000 small files	Done in under 100 MB of memory
The small panel from the right-click menu	Shown in about 0.4 s

Command line (for RPA)

vault-zip-cli.exe compresses, extracts, encrypts PDFs and searches the ledger, from Power Automate for desktop and similar tools.
Results come as JSON; exit codes tell success and the reason for a failure.
Passwords go through standard input, never the command line (which other programs can read).
Starts in about 14 ms.

Management for organisations (licence required)

Per-machine MSI for deployment tools.
Rules users cannot change: no ZIP without a password, password method and minimum length, checking always on, passwords kept out of screen captures, a fixed folder for automatic ledger backups, no external tools, and more.
Rules are deployed from the app, an organisation settings file, Group Policy (ADMX) or Intune.
Licences are checked on the PC only. There is no licence server.

Packages

The SHA-256 of every package is listed on the download page.
Every package includes a list of its components (SBOM, CycloneDX) and the full licence text of each.
How to report a vulnerability: see Security.

System requirements

Windows	Windows 10 or later (64-bit, x64). On Windows 11, Vault-ZIP also appears in the new right-click menu. Not tested on Windows on ARM.
Android	Google Play
Language	Japanese (English is planned)