Vault Desk

Vault Desk is a privacy-first alternative to Google Drive and Dropbox built around one strict rule: the server never sees anything readable. Files are encrypted on your device with XChaCha20-Poly1305 before upload, and the encryption extends to metadata — filenames and folder structure are hidden too, which is the part most "encrypted storage" products quietly skip. Login uses OPAQUE, a password-authenticated key exchange, so your password itself is never transmitted or stored in any form the server could crack later. Sharing is handled through sealed keys rather than public links with a token, so a shared file is decryptable only by the recipient you sealed it for. A Key Transparency log lets you verify that the public keys you're encrypting to are the real ones and haven't been silently swapped — an auditable answer to the standard "how do I know the provider isn't lying?" objection. Account recovery works through a recovery key you hold, since there is by design no server-side reset path. Apps cover iOS, Android and web, so it functions as a normal daily drive rather than a vault you dread opening. Best suited to people handling material where exposure has real consequences — legal, medical, journalistic, financial, or anyone building on top of client data — and to privacy-minded users who want data sovereignty without giving up cross-device sync. Honest limits: zero-knowledge means no server-side full-text search of file contents, lose the recovery key and the data is genuinely unrecoverable, and client-side encryption adds overhead on very large uploads. Those are the trade-offs of the architecture, not bugs — and they're the reason the guarantee holds.