Is ZevSafe really 100% offline and safe?

Yes. ZevSafe makes zero network requests. All encryption runs inside your browser using the native Web Crypto API with strict Content-Security-Policy air-gapping.

Can I preview and play files without unzipping the entire vault?

Yes! ZevSafe includes an instant Decrypted Vault Explorer with an in-browser Cinema Media Player, high-resolution Image Lightbox, and Code/Text reader.

What happens if I forget my password?

There are zero backdoors and no password recovery servers. If you lose your password and recovery sheet, the data cannot be decrypted.

How To Use ZevSafe — Simple Step-by-Step & Technical Architecture Guide

🔒 Step-by-Step: How to Lock (Encrypt) a Folder

Follow these simple steps to turn any folder of photos, videos, or documents into an impenetrable .zev vault file.

1

Open ZevSafe in Your Browser

Go to zevsafe.pages.dev in Chrome, Edge, Safari, Firefox, or Brave. You do not need to create an account, log in, or install anything. You can even disconnect your Wi-Fi — ZevSafe works 100% offline.

2

Select or Drop Your Folder

In the Lock a Folder card on the left, drag and drop your folder onto the dashed drop area, or click Browse Folder. All files and subfolders inside will be included automatically.

3

Set a Strong Password

Type your password and re-enter it in the confirm box. Watch the Strength Meter turn green. Aim for 12+ characters with a mix of letters, numbers, and symbols. Click the eye icon (👁️) to verify what you typed.

4

Print or Save Your Recovery Sheet Crucial Step

Click Download Sheet or Print Sheet under the password box. This creates an offline physical backup of your password, folder name, and encryption date. If you ever forget your password, your data is lost forever, so keep this sheet in a safe place.

5

Optional: Add a 2FA Physical Keyfile Optional 2FA

If you want two-factor security, click + Add 2FA Keyfile and pick any personal file (such as a random image, song, or document). Now, unlocking your vault will require both your password and that exact file!

6

Click "Encrypt & Download"

Click the big purple button. Your computer compresses and encrypts the files locally using multi-core streaming. When finished, your browser automatically downloads a single file named YourFolder.zev. You're done!

🔓 Step-by-Step: How to Unlock (Decrypt) a Vault

Unlock your encrypted vault on any PC, Mac, Linux, or Android device in seconds.

1

Drop Your .zev Vault File

In the Unlock a Vault card on the right, drag and drop your .zev file or click Select .zev File.

2

Enter Your Password & Keyfile

Type the exact password you used during encryption. If you enabled 2FA, attach the same keyfile.

3

Click "Decrypt & Explore" Instant Explorer

Click the teal button. Within 100 milliseconds, ZevSafe authenticates your vault and opens the built-in Decrypted Vault Explorer. You don't even have to wait for the whole archive to unpack!

🎬 Exploring Your Vault Without Unzipping

ZevSafe features a full in-browser operating environment so you can view, play, and extract files instantly on-demand.

🎥

Cinema Media Player

Stream encrypted MP4, WebM, MP3, and AAC files directly inside your browser. Complete with seek bar, volume control, playlist carousel, and fullscreen cinema mode.

🔍

High-Res Image Lightbox

Inspect encrypted photos (PNG, JPEG, WebP, SVG). Zoom in from 25% to 500%, drag-and-pan across massive images, rotate 90°, and check image dimensions.

📄

Code & Document Viewer

Preview text notes, Markdown, JSON, and source code files with numbered line gutters, word-wrap toggle, and a 1-tap "Copy to Clipboard" button.

📦

Selective File Extraction

Don't want the whole multi-gigabyte folder? Click the save icon next to any single file to extract it in under 15 milliseconds, or select multiple files for batch download.

💡 The 4 Golden Rules of ZevSafe

❌ 1. No Password Reset Exists

ZevSafe has zero backdoors and no central database. If you lose your password and recovery sheet, your data is mathematically impossible to recover. Always make a physical backup.

✅ 2. Safe for Cloud & USB

Your .zev vault is completely encrypted with military-grade AES-256-GCM. You can safely store it on Google Drive, Dropbox, or a shared flash drive without anyone reading it.

🔒 3. 100% Offline Capable

Once ZevSafe is opened in your browser or installed as a PWA, you can turn off Wi-Fi or go into Airplane Mode. All processing happens 100% inside your computer's RAM.

⚠️ 4. Never Modify Vault Bytes

Do not rename the file extension or edit the vault in a hex/text editor. AES-GCM includes cryptographic tamper protection — modifying even 1 byte will permanently lock the file.

⚡ Technical Architecture & Cryptographic Specification

An exhaustive engineering reference for cryptographers, security auditors, and system architects.

1. Binary Container Wire Format (`ZV3\0` STREAM AEAD)

ZevSafe vaults adhere to a strict, non-malleable binary container specification designed for memory-bounded multi-gigabyte streaming across Web, Android, and Desktop platforms:

Byte Offset	Size	Field Name	Cryptographic Specification
`0..3`	4 B	`MAGIC`	ASCII literal `ZV3\0` (`0x5A 0x56 0x33 0x00`)
`4`	1 B	`VERSION`	Container revision `0x03`
`5`	1 B	`FLAGS`	Bit 0 (`0x01`): Keyfile 2FA Active; Bit 1 (`0x02`): Reserved
`6..9`	4 B	`CHUNK_SIZE`	Big-endian uint32: `4,194,304` (4 MB AEAD chunk boundary)
`10..41`	32 B	`SALT`	32-byte CSPRNG salt for PBKDF2-HMAC-SHA512
`42..48`	7 B	`BASE_IV_PREFIX`	7-byte CSPRNG base initialization vector prefix
`49..56`	8 B	`MANIFEST_OFFSET`	Big-endian uint64 byte offset to the encrypted tail manifest

2. Deterministic 12-Byte IV & 42-Byte AAD Binding

To eliminate nonce collision vulnerabilities in parallel multi-worker execution, ZevSafe constructs a deterministic 12-byte IV for every 4 MB chunk:

// Deterministic 12-byte Chunk IV Construction (FORMAT.md §3.2)
const iv = new Uint8Array(12);
iv.set(baseIVPrefix, 0);                                // Bytes 0..6:  7-byte random Base IV Prefix
new DataView(iv.buffer).setUint32(7, chunkIndex, false); // Bytes 7..10: 4-byte Big-Endian chunk counter
iv[11] = isLast ? 0x01 : 0x00;                          // Byte 11:     1-byte terminal stream flag
                

Every chunk is cryptographically bound to its exact sequence index and the container header via a 42-byte Authenticated Additional Data (AAD) vector passed into AES-GCM:

// 42-Byte Authenticated Additional Data Layout
[ Magic(4B) ‖ Version(1B) ‖ HeaderSalt(32B) ‖ Uint32BE(chunkIndex)(4B) ‖ isLast(1B) ]
/* Any chunk splicing, deletion, reordering, or bit-flip invalidates the 128-bit GCM tag. */
                

3. Key Derivation & Ephemeral Memory Zeroization

Key derivation uses PBKDF2-HMAC-SHA512 with 600,000 iterations (far exceeding OWASP's 210,000 baseline). If 2FA is active, the physical keyfile is digested with SHA-256 and mixed via bitwise XOR:

// Master Key Derivation & In-Memory Scrubbing (SEC-HIGH-04 Hardened)
const derivedBits = await crypto.subtle.deriveBits(
    { name: 'PBKDF2', salt, iterations: 600000, hash: 'SHA-512' },
    keyMaterial, 256
);
let rawKeyBytes = new Uint8Array(derivedBits);

if (keyfileBytes) {
    const keyfileHash = new Uint8Array(await crypto.subtle.digest('SHA-256', keyfileBytes));
    for (let i = 0; i < 32; i++) rawKeyBytes[i] ^= keyfileHash[i];
    keyfileHash.fill(0); // Zeroize keyfile digest
}

// Non-extractable key import: raw bytes cannot be exported by JavaScript
const masterKey = await crypto.subtle.importKey(
    'raw', rawKeyBytes, { name: 'AES-GCM', length: 256 },
    false, ['encrypt', 'decrypt']
);

rawKeyBytes.fill(0); // Ephemeral RAM zeroization
                

4. Parallel Web Worker Pipeline with Bounded Backpressure

ZevSafe utilizes an elastic worker pool scaling across CPU cores (clamped between 4 and 8 workers) with zero-copy transferable ArrayBuffer transfers:

CreditFlowController: Enforces an adaptive credit window $W = \max(2, \min(12, N \times 2))$ with deferred release, ensuring physical process RAM remains strictly bounded under 105 MB regardless of dataset size.
OrderedReassemblyQueue: Out-of-order chunks completed across parallel threads are resolved into monotonically increasing sequence ($0, 1, 2, \dots$) before writing to disk sinks.
Zero-Copy Transferable Buffers: Buffer ownership is transferred directly across worker contexts via postMessage(msg, [transferable]) without memory duplication, saving over 20 GB of RAM churn on large vaults.

5. Bounded Chunk Cache (`chunkCache`) & Memory Bounds

ZevSafe implements a high-performance, 4-chunk LRU (Least Recently Used) cache (StreamUnpacker.createBoundedChunkCache(4)) capped at exactly 16 MB RAM (4 × 4 MB chunks) for instant video seeking and image zoom:

// Bounded 16 MB LRU Cache Factory (SEC-HIGH-07 Hardened)
StreamUnpacker.createBoundedChunkCache = function(maxChunks = 4) {
    const cache = new Map();
    return {
        get(chunkIndex) {
            if (!cache.has(chunkIndex)) return null;
            const chunk = cache.get(chunkIndex);
            cache.delete(chunkIndex);
            cache.set(chunkIndex, chunk); // LRU refresh
            return chunk;
        },
        set(chunkIndex, chunkBytes) {
            if (cache.has(chunkIndex)) cache.delete(chunkIndex);
            else while (cache.size >= maxChunks) {
                const oldestKey = cache.keys().next().value;
                cache.delete(oldestKey); // Eviction drops reference without buffer-aliasing corruption
            }
            cache.set(chunkIndex, chunkBytes);
        },
        clear() {
            for (const [_, chunk] of cache.entries()) {
                if (chunk && chunk.fill) chunk.fill(0); // Full zeroization strictly on session lock
            }
            cache.clear();
        }
    };
};
                

Buffer Aliasing Immunity: During active multi-chunk extractions (> 16 MB), cache eviction drops the oldest key reference rather than executing in-place .fill(0) zeroization. This prevents buffer corruption when earlier chunks are still being assembled by downstream streams.
Strict RAM Bound: Caps plaintext memory accumulation to 16 MB, strictly adhering to the < 150 MB total process RAM ceiling.
Cryptographic Zeroization: When the vault is locked (lockV3VaultSession), all remaining cached chunks are securely wiped with .fill(0) before cache clearing.

6. PWA Service Worker Shell Cache & Storage Architecture

The ZevSafe Service Worker (sw.js) manages offline caching and streaming download interception under strict security constraints:

App Shell Cache-First Strategy: Pre-caches application code (HTML, CSS, JS, icons) into zevsafe-shell-v42 for instant, air-gapped offline loading without network access.
Strict Vault Bypass Rule: The Service Worker never caches sensitive .zev vault files. A case-insensitive filter (url.pathname.toLowerCase().endsWith('.zev')) bypasses the cache entirely.
Synthetic Tier-2 Download Route: Intercepts /_stream_download with Sec-Fetch-Site validation, rejecting any cross-site request forgery attempts with 403 Forbidden.
Automatic Cache Invalidation: Whenever a new version is released, the Service Worker automatically purges previous cache generations and claims active clients.

7. Formal Security Audit Attestation (Score: 96/100, Grade A+)

ZevSafe has undergone an exhaustive multi-agent security audit evaluating 20 threat vectors across cryptography, concurrency, client-side DOM XSS, and stream interception. Complete audit diffs and interactive verification reports are published at /security-audit/.

❓ Frequently Asked Questions

Yes. ZevSafe makes zero network calls. All cryptographic primitives run inside your local browser sandbox using W3C Web Crypto. The page enforces a strict Content-Security-Policy (CSP) that blocks all outbound socket and HTTP connections. You can inspect your browser's Network tab or run the app with Wi-Fi completely turned off.

Web Browsers (Desktop & Laptop): Seamlessly handles vaults up to 5 GB+ using chunked streaming without browser memory crashes.

Mobile Browsers (Android / iOS): Handles vaults up to 2.5 GB.

For Massive Datasets (25 GB to 100 GB+): Use our 1-Click PC Desktop Setup (25+ GB) toolkit (downloadable directly from the main page). It streams chunks straight to disk using only ~10 MB of RAM!

Yes! Open ZevSafe in Chrome on Android or Safari on iOS to unlock your files directly in the browser.

For mobile users, ZevSafe is an installable, 100% offline Progressive Web App (PWA). You can install it directly from Chrome on Android (Tap ⋮ Menu → "Install app" / "Add to Home screen") or Safari on iOS (Share → "Add to Home Screen") with zero sideloading and instant offline launch.

AES-256-GCM authenticated encryption checks the 128-bit authentication tag before releasing any data. If the password is wrong by even one character, authentication immediately fails with a clean error message. Zero corrupt or partial data is ever leaked.

Chrome / Edge / Brave: Click the install icon in the URL address bar or click "Install App" in the browser menu.

Safari on iPhone / iPad: Tap the Share button (square with arrow) → scroll down → tap Add to Home Screen. It runs in full-screen standalone mode with 100% offline access.