-
0.6.1 Stable
released this
2026-10-13 15:47:30 +02:00 | 0 commits to master since this releaseA maintenance release. The
vaultprogram and its file formats are unchanged from 0.6; vaults and keys move freely between 0.6 and 0.6.1.- CI and tests now pass on every supported platform, including macOS and Windows.
Downloads
-
vault 0.6 Stable
released this
2026-10-08 20:15:00 +02:00 | 5 commits to master since this releaseRewritten in Rust, and much faster. vault 0.6 is a ground-up rewrite. It reads and writes exactly the same key files and vaults as 0.5, byte for byte, so there is nothing to convert: replace the program and carry on. Old and new versions can even share a vault at the same time; they honour each other's locks, and either can use a key the other's
vault unlockis holding.On the same machine, compared with 0.5:
0.5 0.6 List a vault of 500 files 4.95 s 0.74 s 6.7× faster Get one small file back 5.24 s 0.74 s 7.1× faster Add 500 small files 124 s 79 s 1.6× faster Add a 1 GiB file 42 s 30 s 1.4× faster Post-quantum key wrap / unwrap 7.4 ms 3.1 ms 2.4× faster Program size 11.5 MB 3.5 MB 3.3× smaller Every lookup now opens the catalogue in parallel, and the FrodoKEM + ML-KEM maths is about twice as quick. Getting a large file back is slower on purpose: vault now waits until the file is safely on disk before it appears under its name, so a crash or power cut can never leave you holding an empty or half-written copy.
Safer, too:
getnever overwrites anything, not even a symlink or a file that appears while it runs;get -rwon't follow a planted symlink out of the folder you chose.- A file that changes while you add it isn't stored, and
migrateonly deletes an original that is still exactly the file it stored (and never anything inside the vault itself). - Interrupted adds, moves and deletes can't leave an entry pointing at missing data.
vault unlockrefuses to hold your key unless it can protect it: locked memory, no core dumps, and on Linux no debugging by other programs. It reads the key straight into that protected memory.add URLandmirrorhave time and size limits (--timeout,--max-bytes,--max-pages), follow redirects only where they should, and a hostile website can no longer write outside the folder you mirror it into.mirrorexits with status 3 when it had to skip something.absorbnow handles very large files from PAX tar archives correctly.- New
--workers Non every command.
Platforms: builds now cover Linux (x86-64, 32-bit x86, ARM64, ARMv6, ARMv7, RISC-V, LoongArch, POWER little-endian, s390x; all statically linked), macOS (Apple silicon and Intel), Windows (x86-64, 32-bit, ARM64) and FreeBSD (x86-64, 32-bit). The rarer platforms 0.5 also built for (Plan 9, OpenBSD, NetBSD, MIPS, AIX, Solaris, illumos, WebAssembly) are no longer released. On Android, the Linux ARM64 build runs in Termux.
vault unlockis not available on Windows. The macOS binaries are cross-built: foradd URLandmirrorthey trust the standard Mozilla certificate list rather than the macOS keychain.Also: an updated user guide (
vault-guide.pdf) with new screenshots and troubleshooting entries, man pages (vault-man-pages.tar.gz), andSHA256SUMSfor the binaries. Thedixon-vaultpackages on repo.dixon.cx are updated too.Downloads
-
vault 0.5 Stable
released this
2026-10-02 23:13:06 +02:00 | 30 commits to master since this releaseUnlock once, stop typing your passphrase:
vault unlockasks once, then remembers the key for 5 minutes (--for 30mfor longer), likessh-agent. Commands skip the prompt until a hard deadline counted from when you unlocked, so a laptop left open still locks itself;vault lockforgets the key at once. The key reaches a small helper process over a pipe and is never written to disk. The helper keeps it in memory locked against swapping, can't be core-dumped (or, on Linux, debugged), and answers only on a socket in a directory private to your user.VAULT_PASSPHRASE, when set, always wins, so scripts behave as before. While unlocked, anything running as you can use the vault, so lock before handing the machine to anyone.Copy and move like the shell:
vault mvnow moves whole folders, and as withmv, a target ending in/or naming an existing folder means into it (vault mv notes.md ideas/). Newvault cpcopies a file, or a folder with-r. A copy shares the original's encrypted data, so it is instant and takes no extra space, and deleting either leaves the other intact. Neither command overwrites an existing name.Get a whole folder back:
vault get -r FOLDER [-o DIR]decrypts everything under a folder, keeping its structure, with the same never-overwrite, verify-first checks asget.Also: an updated user guide (
vault-guide.pdf) with the new commands and screenshots, man pages (vault-man-pages.tar.gz, now withvault-cp,vault-unlockandvault-lock), andSHA256SUMSfor the binaries.Downloads
-
vault 0.4.1 Stable
released this
2026-10-02 19:15:28 +02:00 | 31 commits to master since this releaseDelete whole folders:
vault rm -r FOLDERdeletes a folder and everything under it, records and encrypted objects, so the space is freed straight away. It lists what will go with the total size and asks first;-fskips the question (and makes a missing name a no-op), sovault rm -rf FOLDERis the one for scripts.vault rm -r /is refused.Browse a folder at a time:
vault lsnow works likels: it shows the sub-folders of a folder once each, ending in/, with their total size and newest date, then the files in it.vault ls photos/2025goes further in.vault liststill lists every file with its full name, for scripts, andvault ls -rdoes the same.Also: an updated user guide (
vault-guide.pdf) with the new commands, man pages (vault-man-pages.tar.gz), andSHA256SUMSfor the binaries.Downloads
-
vault 0.4 Stable
released this
2026-10-02 18:27:07 +02:00 | 32 commits to master since this releaseAdds
vault absorb [FOLDER], which reads a tar archive (gzipped or not) from standard input and stores every file in it, streaming each straight into the vault so nothing is unpacked to disk. For exampletar -cz photos | vault absorb backup, orgpg --decrypt x.tar.gpg | vault absorb secrets. It asks for the passphrase only once the archive starts arriving, so a program feeding the pipe has finished with the terminal first.Also: an updated user guide (
vault-guide.pdf) with screenshots ofabsorbandmirror, man pages forvaultand every command (vault-man-pages.tar.gz), andSHA256SUMSfor the binaries.Downloads
-
vault 0.3 Stable
released this
2026-09-29 19:43:16 +02:00 | 36 commits to master since this releaseAdds
vault mirror, which crawls a website into the vault (single-threaded, Chrome user agent, same host only, links rewritten to relative paths).Also: man pages for
vaultand every command (vault-man-pages.tar.gz), an updated user guide (vault-guide.pdf), andSHA256SUMSfor the binaries.Downloads
-
vault 0.2 Stable
released this
2026-09-28 17:39:45 +02:00 | 39 commits to master since this releaseWhat's new
vault addtakes a URL.vault add https://… [FOLDER]downloads the file (with a Chrome user agent) and stores it under the last part of the address.- New
vault migrate. Works likeadd, then deletes each original once it is stored and removes folders left empty. Before replacing anything already in the vault it lists those files and asks; with no terminal the answer is no, and--yesanswers yes for scripts. - Folders:
add .andadd ..store the folder's contents directly under the destination;add .. FOLDERno longer dropsFOLDER. - Safety: adding or migrating a folder skips the vault and key file if they live inside it.
- User guide updated, with re-shot screenshots and a new one for
migrate. The PDF is attached.
Downloads
Pick the binary for your OS and CPU, check it against
SHA256SUMS, and put it on your PATH asvault. The guide's "Install it" chapter walks through this.Downloads