How the Seqtrix vault works

In one paragraph

Seqtrix encrypts files and folders on your own PC with AES-256-GCM. The key that opens a locked file is made from, or locked with, your password through Argon2id, a deliberately slow and memory-hungry password function, with a fresh random salt for every file. No key is ever written to disk in the clear; a password you save inside a sequence step is, and that is the first of the two caveats below. Encryption, the vault, recovery and secure delete all run on your PC: your files, their contents and the passwords that lock them are never uploaded. There is no backdoor and we cannot reset those passwords. What v0.16.0 added is a 24-word recovery key that only you hold, created the first time you set up or unlock Master Mode, with limits spelled out below.

The cipher

• AES-256 in GCM mode. GCM is authenticated encryption: a wrong password or a single changed byte makes the unlock stop with an error. It never hands back garbage.
• Fresh randomness for every locked file, from the operating system's secure random number generator: a 16-byte salt and a 12-byte nonce. Files locked with the Encrypt step or added to the vault also get their own random 256-bit file key and a second 12-byte nonce for the contents.
• The layout on disk. Every locked file starts with the 4 bytes SFLK. A file from the Encrypt step or the vault goes on with a version tag, the file key locked under your password (salt, nonce and 48 bytes), an optional second locked copy of the file key (nonce and 48 bytes), and then the nonce and the encrypted contents with their 16-byte authentication tag. An Encrypt file has the second copy only if Master Mode was unlocked when it was locked, and that copy is locked with the Master Mode key; every vault item has one, locked with the vault's own key.
• One extension. A locked file gets .sflocked added to its name, so tax-2026.pdf becomes tax-2026.pdf.sflocked. A folder is packed into a zip archive in memory and encrypted as one Folder.sflocked file.
• Password Lock, the step that locks a document, a folder or a program in place, uses the same cipher with the key made straight from your password and the file's salt. Its file starts with a small unencrypted header holding the original name and an Argon2id hash of the password, so a typed password is checked before anything is decrypted.
• Older files keep working. Files locked by v0.15.0 or earlier use the older layout (the key made straight from the password, no recovery copy) and still open with their password.

How your password becomes a key

• Argon2id, version 0x13, with 64 MB of memory (65,536 KiB), 3 passes and 4 lanes, giving a 256-bit key.
• Every guess at your password costs an attacker those 64 MB and three passes, which makes guessing in bulk on graphics cards slow and expensive. It does not save a short password: use a long passphrase.
• The same function with the same settings checks typed passwords against their stored hashes (the master password, vault passwords and Password Lock) and turns the 24-word recovery key into a key.
• Not used anywhere in the app: PBKDF2, scrypt, ChaCha20 or the Windows credential store (searched in the v0.16.0 source on 2026-10-24).

Where the keys live

• Nowhere in the clear. A file from the Encrypt step carries its own key inside it, locked with your password, plus a second copy locked with the Master Mode key if Master Mode was unlocked at the time. A vault item carries its key locked with the vault password and, always, a second copy locked with the vault's own key. A Password Lock key is never stored at all: it is made from your password each time.
• In memory, the app overwrites each key with zeros once it has used it. That is best effort, as in any program: it cannot rule out a stray copy. The one deliberate exception is the Master Mode key, which stays in memory while Master Mode is unlocked, so new Encrypt locks and the vaults you use get their recovery copy, and is wiped when Master Mode locks again, by its timer or by hand.
• Vault password: kept as an Argon2id hash in the vault's index file, vault_manifest.json, so a typed password is checked before anything is added or restored. Since v0.16.0 each vault also has a random key of its own, which locks the second copy of every item's key. The index keeps that vault key locked with the vault password and, once you have used the vault while Master Mode is unlocked, locked with the Master Mode key as well. It also keeps the vault password sealed under the vault key, so the recovery key can still open items added before the recovery kit existed.
• Master password: kept as an Argon2id hash in security_config.json. It does not encrypt your files. It turns on Master Mode, which hides the sequences you create while it is on from Home, Quick Run and the schedule picker until you type it; each Security Lock step keeps its own password. Since v0.16.0 Master Mode also has a random key, locked with the master password and again with your recovery key. A file you lock with the Encrypt step while Master Mode is unlocked carries a copy of its key locked with it, and so does the key of every vault you use while Master Mode is unlocked. So a strong master password matters too.

Two caveats, printed in full

1. Step passwords are saved on this PC as you typed them. Every lock in Seqtrix runs as a step in a sequence, and the step keeps its password so the sequence can run from a hotkey or a schedule without asking you. It is stored in plain text in the sequence file, sequences.json, and its backup copy, sequences.bak.json, in Seqtrix's data folder, and a step with a scheduled unlock also copies it into scheduled_unlocks.json until the unlock has run. Anyone who can read the files in your Windows account can read those passwords: someone signed in as you, an administrator of the PC, or someone who takes the drive out of a PC without drive encryption. Master Mode hides sequences inside the app; it does not encrypt these files. The passwords never leave the PC: cloud backup and shared links strip them. What helps: a Windows account of their own for everyone who uses the PC, drive encryption (BitLocker or Device encryption), and step passwords you use nowhere else.
2. File names are not encrypted. The contents are; the names and places are not. A locked file keeps its name with .sflocked added. The vault stores items under random names, but its index, vault_manifest.json, lists each item's original name, original path, size and date added in plain text. A Password Lock file carries its original name in its plain header, and the security log, security_log.json (the last 1,000 events), records the path of every item a Security Lock step acts on. If a name gives too much away, rename the file before you lock it.

Where your files go

Seqtrix keeps its own files in a data folder in your Windows profile; Settings > About > Storage location shows the exact path.

• Encrypt, a file: tax-2026.pdf.sflocked is written next to the original. With Delete original on, which is how the step starts, the original is then overwritten once with random data and deleted.
• Encrypt, a folder: the folder is zipped in memory and written as Folder.sflocked where it was, and the original folder is then deleted the normal way, whether Delete original is on or not. It is not overwritten first, so on a hard disk a recovery tool can find the old files until Windows reuses that space. If that matters, run cipher /w:C:\ (with your drive letter) afterwards: Microsoft's cipher reference says it removes data from the unused space on the whole volume.
• Password Lock: the document, folder or program becomes name.sflocked in the same folder (a folder is zipped first), and the original is deleted the normal way, without an overwrite.
• Secure Vault: each file is encrypted into the data folder, under .vault\vaults\<vault name>\, with a random 16-character name ending in .sflocked. With Delete originals on, which is how the step starts, the original is then overwritten once and deleted.
• Hide is not encryption. Basic sets the Hidden and System attributes and leaves the item where it is. Deep moves it into .vault\hidden\ in the data folder, under a folder named from a hash of its original path, and keeps a list of where it came from; the files stay readable to anyone who looks there.
• Encrypt refuses critical Windows locations such as C:\Windows and asks you to confirm before it touches Program Files, ProgramData or an AppData folder.

If you forget the password

We cannot reset a step, vault or master password, and no email or support ticket can open your files. What v0.16.0 added is the recovery kit:

• The first time you set up or unlock Master Mode, Seqtrix shows a 24-word recovery key once, with Print and Save as PDF. It keeps no copy of the words, only the Master Mode key locked under them, in this PC's data folder.
• The words open Master Mode and let you set a new master password; your files and vaults keep opening and the printed kit stays valid. Changing the master password the normal way keeps the kit valid too.
• They open files and folders you locked with the Encrypt step while Master Mode was unlocked, and any vault you created or used with its password while Master Mode was unlocked.
• For any other file (a Password Lock, a file you encrypted while Master Mode was locked, a file from v0.15.0 or earlier), the recovery key can only fall back to the password saved in the sequence step that locked it, and only while that sequence is still on this PC. A vault you never used while Master Mode was unlocked is out of its reach.
• Removing the master password, rather than changing it, deletes that locked Master Mode key, so the old words stop working. Setting a master password again creates a new key and a new kit: Encrypt files that carry a copy under the old key then open only with their own passwords, and each vault gets its recovery copy back the next time you use it with its password while Master Mode is unlocked.
• Lose both the password and a recovery key that covers the file, and it stays encrypted. Nobody can open it, us included.

The 24 words are as strong as your passwords: whoever holds them can open Master Mode and everything listed above. The kit itself says to keep the printout with your passport or tax papers, not next to the computer. And keep a normal backup of anything irreplaceable somewhere else before you lock the only copy.

Secure delete, and the truth about SSDs

What Seqtrix does

• Three strengths: Quick (1 pass), Standard (3 passes, the default) and Thorough (7 passes).
• Each pass overwrites the whole file from the first byte to the last in 1 MB chunks: random data on pass 1, all ones on pass 2, all zeros on pass 3, then the same cycle again. Every pass is flushed and synced to the disk before the next one starts, and then the file is deleted. A folder is walked and every file in it gets the same treatment before the folder is removed.
• The overwrite behind Delete original (Encrypt) and Delete originals (vault) is a single random pass.
• What it does not do: it does not rename the file or change its size first, so the file system can still show that a file of that name and size existed. Microsoft's free SDelete renames a file 26 times before deleting it. If the name itself is sensitive, rename the file to something plain before you shred it. The security log also keeps the path, as caveat 2 says.

On a hard disk

For an ordinary file the overwrite lands on the same sectors, so a recovery tool reads back the overwrite pattern, not your data. The exceptions are files that NTFS stores compressed, encrypted with EFS or sparse: NTFS writes changes to those files to new clusters, so the old data stays where it was. Microsoft's SDelete page explains this, and it applies to any tool that overwrites through normal file writes, Seqtrix included.

On an SSD, honestly

• The drive's controller decides where each write lands, to spread wear across its flash cells, so an overwrite can go to fresh cells while the old ones keep your data until the drive erases them. No program running in Windows can see or prove when that happens.
• TRIM tells the drive which blocks are free so it can erase them; when it does is up to the drive. Microsoft's fsutil behavior reference says TRIM is on by default for NTFS unless an administrator turned it off. Check it with the command below: 0 means on.

fsutil behavior query DisableDeleteNotify

• So after a secure delete on an SSD, recovery tools running in Windows will not find the file, but a lab reading the flash chips directly cannot be ruled out. If that is your threat, turn on drive encryption (BitLocker, or Device encryption where your PC offers it) so every leftover block is ciphertext, and use the drive maker's secure-erase tool when you retire the drive.
• On any disk, copies elsewhere are untouched: backups, shadow copies, cloud folders and other devices keep their own.

What leaves your PC

None of the security features use the network: locking, unlocking, the vault, recovery and secure delete all run on your PC. Seqtrix itself goes online for the following, and only the first two run without you turning them on:

• Plan check: on launch and every 30 minutes the app confirms your plan by sending a hashed ID for this device; if you are signed in, the request also carries your sign-in. Offline, it keeps the last answer for 24 hours, then falls back to Starter until it can check again.
• Update check: on launch it looks for a newer version and downloads it in the background; you choose when to restart.
• Crash reports: off unless you turn them on in Settings > Privacy. When on, a crash sends the error details, the app version, the Windows version and the screen you were on, never your sequences or files.
• Usage statistics: off unless you turn them on in Settings > Privacy.
• Cloud backup: off unless you sign in and turn it on, on Advanced or Pro. It copies each sequence you save to your account, encrypted at rest, not end to end. A sequence names the files and folders its steps point at, so those paths go with it; the step passwords never do.
• Things you do on purpose: signing in, buying a pass, publishing a shared sequence (its Security Lock targets and passwords are never shared) and setting up Describe (AI), which downloads its model once and then runs offline.

The privacy policy has the full list.

What the vault is not

• Not full-disk encryption. BitLocker encrypts whole drives against a lost or stolen PC; it comes with Windows Pro and up, and Device encryption turns the same encryption on automatically on supported PCs, on every edition. Seqtrix locks the files and folders you choose on a running PC. They cover different risks, so use both.
• Not VeraCrypt. Seqtrix has no encrypted drive to mount, no hidden volumes and no plausible deniability, its code is not open source, and it has not had an independent security audit. If you want a free, open-source encrypted container that you mount as a drive, use VeraCrypt. What Seqtrix adds is the lock as a step: a folder that locks itself at 6 pm, on a hotkey or when an app starts, without mounting anything.
• Not a password manager. It does not keep your other passwords.
• Not a backup. The vault lives on this PC only, and an encrypted file is only as safe as the copy you keep somewhere else.
• Not protection for an open file. Unlocking writes the plain file back to disk, and until you lock it again anything running as you can read it.
• Password Lock rewrites a program's file, so it only works on programs whose files your Windows account can change.

Which plan you need

Encrypt, Hide and Password Lock run on every plan, including the free Starter plan, where up to 2 sequences can hold a security step. The Secure Vault and Secure Delete steps need Advanced (up to 30 such sequences) or Pro (no limit): on Starter you can add them to a sequence, and it runs once your plan allows. Every PC can start one 15-day Advanced trial, with one click from any upgrade prompt. If a pass ends, files already in a vault stay openable: the plan decides whether the vault step runs, not whether you can restore what is in it. Plans and prices.

FAQ

Keep going

• Password-protect a folder on Windows 11
• Hide a folder on Windows 11
• Securely delete files on Windows 11
• Encrypt a file on Windows without BitLocker
• Master Mode and the rest of the security toolkit

Spotted something wrong? Write to help@seqtrix.com and the page gets fixed. Param Nimbark, founder of Seqtrix.