Oct 2026 - Present · Developer
nullguard
Encrypted, quantum-resistant file vaults that mount as ordinary drives.
Overview
nullguard is a small, open-source alternative to VeraCrypt, written in Rust. A vault is a single ordinary file. Unlocked with a password or keyfile, it appears as a normal folder; locked, it is an opaque blob in which file contents, names, sizes, and directory structure are all encrypted and authenticated.
Design
Data is encrypted with XChaCha20-Poly1305, passwords are stretched with memory-hard Argon2id (1 GiB by default), and hashing uses SHA-256, all from audited Rust crates. Every chunk is authenticated and bound to its position and version, so modified, moved, swapped, or rolled-back blocks are detected, as is an old header restored to revive a removed password or keyfile. Copy-on-write storage with atomic commits keeps a vault consistent through crashes and power loss. Because every key is a 256-bit symmetric key or derived from a password, there is no public-key cryptography for a quantum computer to break.
Platforms
nullguard ships as one portable binary with no installer, runtime, or driver of its own. Vaults mount through FUSE on Linux and macOS and through WinFsp on Windows, and offline commands for copying files in and out and verifying integrity work everywhere with nothing else installed. Keyfiles can be added for scripts, recovery, or a second person.
Status
nullguard is at v0.2 and has not yet been independently audited. Unlike VeraCrypt, it does not offer system-drive encryption or hidden volumes. An outside audit, incremental metadata for larger vaults, and resizing are on the roadmap.