hackeralert / picocrypt

A very small, very simple, yet very secure encryption tool.

Picocrypt is a very small (hence Pico), very simple, yet very secure encryption tool that you can use to protect your files. It's designed to be the go-to tool for encryption, with a focus on security, simplicity, and reliability. Picocrypt uses the secure XChaCha20 cipher and the Argon2id key derivation function to provide a high level of security, even from three-letter agencies like the NSA. Your privacy and security is under attack. Take it back with confidence by protecting your files with Picocrypt.

Funding

Please donate to Picocrypt on Open Collective (crypto is accepted) to raise money for a security audit from Cure53. Because this is a project that I spend many hours on and make no money from, I cannot pay for an audit myself. Picocrypt needs support from its community.

Downloads

Important: There are multiple entities under the name "Picocrypt". For example, there's an old encryption tool called PicoCrypt that uses a broken cipher. There's also an ERC-funded research project called PICOCRYPT. There are even domains related to Picocrypt that I've never registered like picocrypt.com and picocrypt.org. Please don't confuse any of these unrelated (and potentially malicious) projects/domains with Picocrypt (this project). Make sure to only download Picocrypt from this repository to ensure that you get the authentic and backdoor-free Picocrypt. When sharing Picocrypt with others, be sure to link to this repository to prevent any confusion.

Beware of picocrypt.org, which claims to be the official website for this project! Remember, there is no official website for Picocrypt. Even if this self-proclaimed website is taken down, I will not remove this message; let it be a real-world warning to stay vigilant.

Windows

Picocrypt for Windows is as simple as it gets. To download the latest, standalone, and portable executable for Windows, click here. If Microsoft Defender or your antivirus flags Picocrypt as a virus, please do your part and submit it as a false positive for the betterment of everyone.

If you use Picocrypt frequently, you can also download the installable version from here, which will install Picocrypt onto your system and add it to your start menu for easy access. The installer also includes extra compatibility helpers, so if the portable executable doesn't work, this likely will.

macOS

Picocrypt for macOS is very simple as well. Download Picocrypt here, extract the zip file, and run Picocrypt which is inside. If you can't open Picocrypt because it's not from a verified developer, control-click on Picocrypt and hit Open to bypass the warning. Note that the standard release targets x86-64 systems so you may need Rosetta 2, but you can compile from source on Apple silicon to run Picocrypt natively. Also note that Picocrypt requires OpenGL, and may not work in the future if Apple removes it.

Linux

To use Picocrypt on Linux, you can download the AppImage here. While this AppImage should work on most systems, Linux is a mess when it comes to cross-distro and cross-release compatibility, so if the AppImage doesn't work, you can try the Snap, run Picocrypt through Wine, or compile from source using the instructions in the src/ directory.

CLI

A command-line interface is available for Picocrypt here. It can encrypt and decrypt files, folders, and globs, and supports paranoid mode and Reed-Solomon encoding. You can use it on systems that don't have a GUI or can't run the GUI app, or to write automated shell scripts for backups, etc.

Web

A web interface for Picocrypt is available here, allowing you to use a lite version of Picocrypt on any device. Keep in mind that its functionality is very limited and you won't be able to use any advanced features or encrypt large files. It is also quite slow compared to the native app.

Paranoid Pack

The Paranoid Pack is a compressed archive that contains executables for Windows, macOS, and Linux, including the source code and dependencies. As long as you have it stored in a place you can access, you'll be able to open it and use Picocrypt on any desktop operating system in case this repository mysteriously vanishes or the entire Internet burns down. Think of it as a seed vault for Picocrypt; as long as one person has the Paranoid Pack within reach, they can share it with the rest of the world and keep Picocrypt functional in case of catastrophic events. The best way to ensure Picocrypt is accessible many decades from now is to keep a Paranoid Pack in a safe place. Get your copy here.

Why Picocrypt?

Why should you use Picocrypt instead of VeraCrypt, 7-Zip, BitLocker, or Cryptomator? Here are a few reasons why you should choose Picocrypt:

• Unlike BitLocker and most cloud services, Picocrypt and its dependencies are completely open-source and auditable. You can verify for yourself that there aren't any backdoors or flaws.
• Picocrypt is tiny. While Cryptomator is over 50 MiB and VeraCrypt is over 20 MiB, Picocrypt sits at just 3 MiB, about the size of a medium-resolution photo. And that's not all - Picocrypt is portable (doesn't need to be installed) and doesn't require administrator/root privileges.
• Picocrypt is easier and more productive to use than VeraCrypt. To encrypt files with VeraCrypt, you'd have to spend a minute or two just setting up a volume. With Picocrypt's simple UI, all you have to do is drag and drop your files, enter a password, and hit Encrypt. All the complex procedures are handled by Picocrypt internally. Who said secure encryption can't be simple?
• Picocrypt is designed for security. 7-Zip is an archive utility and not an encryption tool, so its focus is not on security. Picocrypt, however, is built with security as the number one priority. Every part of Picocrypt exists for a reason and anything that could impact the security of Picocrypt is removed. Picocrypt is built with cryptography you can trust.
• Picocrypt authenticates data in addition to protecting it, preventing hackers from maliciously modifying sensitive data. This is useful when you are sending encrypted files over an insecure channel and want to be sure that it arrives untouched.
• Picocrypt actively protects header data from corruption by adding extra Reed-Solomon parity bytes, so if part of a volume's header (which contains important cryptographic components) corrupts (e.g., hard drive bit rot), Picocrypt can still recover the header and decrypt your data with a high success rate. Picocrypt can also encode the entire volume with Reed-Solomon to prevent any corruption to your important files.

Comparison

Here's how Picocrypt compares to other popular encryption tools.

	Picocrypt	VeraCrypt	7-Zip GUI	BitLocker	Cryptomator
Free	✅ Yes	✅ Yes	✅ Yes	✅ Bundled	✅ Yes
Open Source	✅ GPLv3	✅ Multi	✅ LGPL	❌ No	✅ GPLv3
Cross-Platform	✅ Yes	✅ Yes	❌ No	❌ No	✅ Yes
Size	✅ 3 MiB	❌ 20 MiB	✅ 2 MiB	✅ N/A	❌ 50 MiB
Portable	✅ Yes	✅ Yes	❌ No	✅ Yes	❌ No
Permissions	✅ None	❌ Admin	❌ Admin	❌ Admin	❌ Admin
Ease-Of-Use	✅ Easy	❌ Hard	✅ Easy	✅ Easy	🟧 Medium
Cipher	✅ XChaCha20	✅ AES-256	✅ AES-256	🟧 AES-128	✅ AES-256
Key Derivation	✅ Argon2	🟧 PBKDF2	❌ SHA-256	❓ Unknown	✅ Scrypt
Data Integrity	✅ Always	❌ No	❌ No	❓ Unknown	✅ Always
Deniability	✅ Supported	✅ Supported	❌ No	❌ No	❌ No
Reed-Solomon	✅ Yes	❌ No	❌ No	❌ No	❌ No
Compression	✅ Yes	❌ No	✅ Yes	✅ Yes	❌ No
Telemetry	✅ None	✅ None	✅ None	❓ Unknown	✅ None
Audited	❌ Donate	✅ Yes	❌ No	❓ Unknown	✅ Yes

Keep in mind that while Picocrypt does most things better than other tools, it's not a one-size-fits-all and doesn't try to be. There are use cases such as full-disk encryption where VeraCrypt and BitLocker would be a better choice. So while Picocrypt is a great choice for the majority of people, you should still do your own research and use what's best for you.

Features

Picocrypt is a very simple tool, and most users will intuitively understand how to use it in a few seconds. On a basic level, simply dropping your files, entering a password, and hitting Encrypt is all that's needed to encrypt your files. Dropping the output back into Picocrypt, entering the password, and hitting Decrypt is all that's needed to decrypt those files. Pretty simple, right?

While being simple, Picocrypt also strives to be powerful in the hands of knowledgeable and advanced users. Thus, there are some additional options that you may use to suit your needs.

• Password generator: Picocrypt provides a secure password generator that you can use to create cryptographically secure passwords. You can customize the password length, as well as the types of characters to include.
• Comments: Use this to store notes, information, and text along with the file (it won't be encrypted). For example, you can put a description of the file you're encrypting before sending it to someone. When the person you sent it to drops the file into Picocrypt, your description will be shown to that person.
• Keyfiles: Picocrypt supports the use of keyfiles as an additional form of authentication (or the only form of authentication). Any file can be used as a keyfile, and a secure keyfile generator is provided for convenience. Not only can you use multiple keyfiles, but you can also require the correct order of keyfiles to be present for a successful decryption to occur. A particularly good use case of multiple keyfiles is creating a shared volume, where each person holds a keyfile, and all of them (and their keyfiles) must be present to decrypt the shared volume. By checking the "Require correct order" box and dropping your keyfile in last, you can also ensure that you'll always be the one clicking the Decrypt button.
• Paranoid mode: Using this mode will encrypt your data with both XChaCha20 and Serpent in a cascade fashion, and use HMAC-SHA3 to authenticate data instead of BLAKE2b. Argon2 parameters will be increased significantly as well. This is recommended for protecting top-secret files and provides the highest level of practical security attainable. For a hacker to break into your encrypted data, both the XChaCha20 cipher and the Serpent cipher must be broken, assuming you've chosen a good password. It's safe to say that in this mode, your files are impossible to crack. Keep in mind, however, that this mode is slower and isn't really necessary unless you're a government agent with classified data or a whistleblower under threat.
• Reed-Solomon: This feature is very useful if you are planning to archive important data on a cloud provider or external medium for a long time. If checked, Picocrypt will use the Reed-Solomon error correction code to add 8 extra bytes for every 128 bytes of data to prevent file corruption. This means that up to ~3% of your file can corrupt and Picocrypt will still be able to correct the errors and decrypt your files with no corruption. Of course, if your file corrupts very badly (e.g., you dropped your hard drive), Picocrypt won't be able to fully recover your files, but it will try its best to recover what it can. Note that this option will slow down encryption and decryption speeds significantly.
• Force decrypt: Picocrypt automatically checks for file integrity upon decryption. If the file has been modified or is corrupted, Picocrypt will automatically delete the output for the user's safety. If you would like to override these safeguards, check this option. Also, if this option is checked and the Reed-Solomon feature was used on the encrypted volume, Picocrypt will attempt to recover as much of the file as possible during decryption.
• Split into chunks: Don't feel like dealing with gargantuan files? No worries! With Picocrypt, you can choose to split your output file into custom-sized chunks, so large files can become more manageable and easier to upload to cloud providers. Simply choose a unit (KiB, MiB, GiB, or TiB) and enter your desired chunk size for that unit. To decrypt the chunks, simply drag one of them into Picocrypt and the chunks will be automatically recombined during decryption.
• Compress files: By default, Picocrypt uses a zip file with no compression to quickly merge files together when encrypting multiple files. If you would like to compress these files, however, simply check this box and the standard Deflate compression algorithm will be applied during encryption.
• Deniability: Picocrypt volumes typically follow an easily recognizable header format. However, if you want to hide the fact that you are encrypting your files, enabling this option will provide you with plausible deniability. The output volume will indistinguishable from a stream of random bytes, and no one can prove it is a volume without the correct password. This can be useful in an authoritarian country where the only way to transport your files safely is if they don't "exist" in the first place. Keep in mind that this mode slows down encryption and decryption speeds, requires you to manually rename the volume afterward, renders comments useless, and also voids the extra security precautions of the paranoid mode, so you should only use it if absolutely necessary.
• Recursively: If you want to encrypt and/or decrypt a large set of files individually, this option will tell Picocrypt to go through every recursive file that you drop in and encrypt/decrypt it separately. This is useful, for example, if you are encrypting thousands of large documents and want to be able to decrypt any one of them in particular without having to download and decrypt the entire set of documents. Keep in mind that this is a very complex feature that should only be used if you know what you are doing.

Security

For more information on how Picocrypt handles cryptography, see Internals for the technical details. If you're worried about the safety of me or this project, let me assure you that this repository won't be hijacked or backdoored. I have 2FA (TOTP) enabled on all accounts with a tie to Picocrypt (GitHub, Reddit, Google, etc.), in addition to full-disk encryption on all of my portable devices. For further hardening, Picocrypt uses my isolated forks of dependencies and I fetch upstream only when I have taken a look at the changes and believe that there aren't any security issues. This means that if a dependency gets hacked or deleted by the author, Picocrypt will be using my fork of it and remain completely unaffected. You can feel confident about using Picocrypt.

Signatures

For the paranoid, Picocrypt is signed with PGP. The fingerprint and public key are listed below.

B342A744BDEEA57B6A583E33A247E73798946F55

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEYoGUHxYJKwYBBAHaRw8BAQdAvmQA+pdbDB/ynJxHhNDpz6Sb5tgkNuuNJIvw
HYwZtqi0CVBpY29jcnlwdIiTBBMWCgA7FiEEs0KnRL3upXtqWD4zokfnN5iUb1UF
AmKBlB8CGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQokfnN5iUb1UZ
RgEA8jbIsdqCr21DWxcqW/eLlbxRkuA8kflVYvWWUxtVqsUA/jQPSDpvA8rakvaL
PIbXjQvrAMkEVIc0HbCzLxr1k3sH
=YFwz
-----END PGP PUBLIC KEY BLOCK-----

Community

Keep an eye on r/Picocrypt. While I won't be active in this subreddit myself, it's still a great place to ask questions and help one another out, especially if something happens to me or this repository in the future. Remember to only trust this specific subreddit and be aware of hackers that might try to impersonate me on other platforms. I will never ask you for your password, and anyone who does is not me. I will never tell you to download a file from a suspicious link, and anyone who does is not me.

Donations

When I was actively developing Picocrypt, I accepted donations, but now that Picocrypt is complete and production-ready, there's no need anymore. Instead, take your time and effort to share the love of Picocrypt with others. Donations are nice, but being able to help others is a lot more valuable to me than a few spare dollars. Knowing that Picocrypt is helping people secure their files is plenty enough for me.

FAQ

Is Picocrypt accepting new features?

No, Picocrypt is considered feature-complete and won't be getting any new features. Unlike other tools which try to constantly add new features (which introduces new bugs and security holes), Picocrypt focuses on just a few core features but does each of them exceptionally well. Remember Picocrypt's ideology: small, simple, and secure.

Will Android/iOS be supported?

No, I don't plan on supporting Android or iOS because they are very different from traditional desktop operating systems and require different toolchains to develop apps for. Due to the nature of open-source software, however, a community-built version of Picocrypt for Android or iOS may appear in the future.

Why is Picocrypt not updated frequently?

People seem to have the notion that software must be constantly updated to stay relevant and secure. While this may be true for a lot of the software we use today, it is not for Picocrypt. Picocrypt is "good software" and good software doesn't need constant updates to remain relevant and secure. Good software will always be good software.

Does the "Delete files" feature shred files?

No, it doesn't shred any files and just deletes them as your file manager would. On modern storage mediums like SSDs, there is no such thing as shredding a file since wear leveling makes it impossible to overwrite a particular sector. Thus, to prevent giving users a false sense of security, Picocrypt doesn't include any shredding features at all.

Is Picocrypt quantum-secure?

Yes, Picocrypt is secure against quantum computers. All of the cryptography used in Picocrypt works off of a private key, and private-key cryptography is considered to be resistant against all current and future developments, including quantum computers.

Acknowledgements

A thank you from the bottom of my heart to the significant contributors on Open Collective:

• donor39 (backer)
• Pokabu (backer)
• akp (backer)
• Marvin (backer)
• Kenichi Nakasaka (backer)
• EN (backer)
• JC (backer)
• Guest ($842)
• YellowNight ($818)
• evelian ($50)
• jp26 ($50)
• guest-116103ad ($50)
• Guest ($27)
• oli ($20)
• Bright ($20)
• Incognito ($20)
• Guest ($20)
• Markus ($15)
• Tybbs ($10)
• N. Chin ($10)
• Manjot ($10)
• Phil P. ($10)
• Raymond ($10)
• Cohen ($10)
• EuA ($10)
• geevade ($10)
• Guest ($10)
• Hilebrinest ($10)
• gabu.gu ($10)
• Boat ($10)
• Guest ($10)

Also, a huge thanks to the following people who were the first to donate and support Picocrypt:

• W.Graham
• N. Chin
• Manjot
• Phil P.
• E. Zahard

Finally, thanks to these people/organizations for helping me out when needed:

• [ REDACTED ] for helping me create an AppImage for Picocrypt
• u/Upstairs-Fishing867 for helping me test PGP signatures
• u/greenreddits for constant feedback and support
• u/Tall_Escape for helping me test Picocrypt
• u/NSABackdoors for doing plenty of testing
• @samuel-lucas6 for feedback, suggestions, and support
• @AsuxAX and @Minibus93 for testing new features
• @mdanish-kh and @stephengillie for WinGet package
• PrivacyGuides for listing Picocrypt

picocrypt's Issues

The Password checker is wrong

Idk how it's called, but when setting a password for the file, it says that "password1." is strong (green bar) and "password1" is medium strong (orange bar)

You could solve this by implementing "zxcvbn"

Thanks

Picocrypt don't start

Hello, in xUbuntu 20.04 Picocrypt show error:

$ picocrypt
panic: failed to create window: VersionUnavailable: GLX: Failed to create context: GLXBadFBConfig

goroutine 1 [running, locked to thread]:
github.com/HACKERALERT/giu.NewMasterWindow({0x8b4d1d, 0x9}, 0x13e, 0x1df, 0xa0?)
	/root/go/pkg/mod/github.com/!h!a!c!k!e!r!a!l!e!r!t/[email protected]/MasterWindow.go:73 +0x626
main.main()
	/root/parts/picocrypt/build/Picocrypt.go:1719 +0x38

As i understand problem with openGL version.
How correct it?
Thank!

Feature Request : File & Folder Names Obfuscation

Would it be possible to implement this feature to (optionally) hide the names of the encrypted file(s) and folder(s) ?

In some cases those names may contain valuable information on the files and folders contents that one would prefer to keep private / concealed / protected from outside view.

To further clarify this request, it is probably easiest to refer to a similar feature that worked quite well in the GUI version of Kryptor (now defunct in the latest CLI only version), as described on the following page :

https://www.kryptor.co.uk/technical-details (See : "File name obfuscation")

To check or test this, you can download the last (portable) GUI version of that software there :

https://github.com/samuel-lucas6/Kryptor/releases/tag/v2.2.2

Thanks for all the hard work already done on Picocrypt !
It is well on its way to becoming a must have security tool.

Nuitka / Numba ?

Hi,

thanks for awesome app! Still performance, unfortunately, is not the best... And you explain why.

Looks like Nuitka has significant performance gain vs CPython which in theory could add some extra speed:

https://speedcenter.nuitka.net

There are more related projects, e.g. Numba looks promising: https://numba.pydata.org

Would be glad to learn your opinion!

Cheers

[Suggestion] Comparison Table between other encryption software

It would be interesting a comparison table like this https://www.cryfs.org/comparison It is at the end of the page.

Some of the possible software to compare: cryfs (can be used with sirikali GUI), finalcrypt, cryptomator, veracrypt and zulucrypt.

malware detected in Windows version

https://www.virustotal.com/gui/file/f1e685d2e93093a79cfe49a8afda0499758724fd80a9249b3733c5e231c3a9a2

Blake3 instead of Blake2b

You are currently using Blake2b in fast mode, but why not its successor, Blake3?
It is much faster as Blake2b, but at least as secure as SHA3. (See their comparison chart at their GitHub page.)

Official Flatpak either along with or a replacement for snap

Having an official Flatpak would be better than having a snap package.

Flatpaks work everywhere. Snaps only work on distros with systemd and app images require glibc.

Secondly, snaps don't really provide better security than Flatpaks. Many security researchers who have criticized Flatpaks have also criticized snaps. At least flatpak have put effort into fixing these issues.

https://theevilskeleton.gitlab.io/2021/02/11/response-to-flatkill-org.html

Flatpak still has issues, but they are constantly improving and are much better at being a universal package manager than snap.

Does picocrypt support both argon2d and argon2id ?

[Not A Bug] Storage

This is just a storage space for me to link and backup files.

Random filename

Can you add encrypted filenames as well or at least the optionality for random filename?

Add .zip to filename when custom output location is chosen

I'm currently testing Picocrypt because I like the idea and functionality behind this lightweight tool. I believe my rather "non-techy" perspective can be of value (in terms of expectations and workflow).

Usecase

As a user I want to chose a custom output (~ save to) location for my decrypted folder. This option is available; but:

Possible issue

I navigate to my desired location and define a file name without adding an extension. The file type drop-down menu is empty. I just leave it that way (especially because I can't select anything anyways). This results in a decrypted file without a file type that is somewhat unusable for a non-techy user. Solution: I should have added .zip to my filename.

So far I've only tested this with a folder (→ .zip). Doing this with a single file might lead to a similar experience.

Possible solution

Force add the correct file extension or provide an exemplary file name (e.g. based on encrypted file name) in the explorer window including the correct file extension instead of leaving it empty.

Environment

• Windows 10, 64bit
• Version 1.17 stable

Cannot decrypt file on macOS

I have release 1.27 of Picocrypt installed on an Intel Mac with Monterey 12.3.1. After encrypting a folder, I am unable to decrypt it and receive an error message: The document “test-folder_secure.zip.pcv” could not be opened. Picocrypt cannot open files of this type.

The gif below shows the process:

Let me know if you need more information—I'm happy to help!

Windows Version - Does not Open

Hello there ,
I am using 32 bit desktop computer with Windows 8.1 and I tried 7 releases of Picocrypt but some of them are not even compatible with my pc and the rest do not even open. I tried the installer version as well and it is successfully installed but does not open at all , no responses.

Is there any solution for this?
And would you mind telling me the required system for this software to work?
Mine is 32bit - Ram 2GB - CPU 2.5 Ghz & Windows 8.1

Update the executable icon with high definiton ones

Support at least 256x256 size for the .ico file which is todays standart.
Preferably under PNG container for better quality.
Also provide lower sizes for ensuring compability.
Sample Icon group size chart:
16x16
32x32
48x48
64x64
96x96
128x128
256x256

Existing file gets deleted even if password is wrong

During the decryption of a file, if a file with the same name exists, Picocrypt asks if I want to overwrite it. Answering Yes, but giving the wrong password deletes the existing file anyway.

translation for Chinese

my time will spare in about two-months future.
wait me!

Automatically add encrypted file when .pcv file is opened with Picocrypt

I'm currently testing Picocrypt because I like the idea and functionality behind this lightweight tool. I believe my rather "non-techy" perspective can be of value (in terms of expectations and workflow).

This is a small one that would make working with Picocrypt a little easier.

Usecase / Expectation

Windows lets users define programs to open files with specific file types/extensions. I've set Picocrypt to open .pcv files. My expectation when opening e.g. EncryptedFolder123.zip.pcv with Picocrypt is Picocrypt to open with most things prefilled and without the need to again select the file I want to decrypt.

What actually happens

Double-clicking EncryptedFolder123.zip.pcv does open Picocrypt – that's it. It's the same as double-clicking the Picocrypt.exe. I still have to drag & drop EncryptedFolder123.zip.pcv into that newly opened window.

Environment

• Windows 10, 64bit
• Version 1.17 stable

[Not a Bug] FAQ (Work in progress)

Frequently Asked Questions

You may have some questions about how Picocrypt works, what you can do with it, or why it doesn't work. Most of your questions will probably be answered here, so read on!

To do
"Can I use Pico for my cloud storaged files?"
"Why there is a paranoid mode, is not Pico safe enough?
"Does my password strength matters?"
"Can I use Pico on older devices?"

General

Will Android/iOS be supported?
No, I won't support Android or iOS because they are very different from desktop operating systems and require a lot of work to compile for. The native language for Android apps is Java and the native language for Apple is Swift, however, Picocrypt is written in Go. While Go does have some Android support, the underlying GUI library used by Picocrypt doesn't support Android. Fortunately, since Picocrypt is open source, there may be a community-based Android port in the future, which I would be happy to merge in and maintain. For iOS, it is much more difficult because Apple has deprecated OpenGL from iOS and macOS to push their own proprietary Metal framework. Picocrypt requires OpenGL to run, and if Apple doesn't support the widely-adopted standard, it is impossible to have an iOS app (shame on you, Apple).

Why does my antivirus think Picocrypt is a virus?
Unfortunately, due to the nature of Picocrypt, it can look like a virus to antiviruses. Picocrypt contains code for encryption, which is seen in ransomware, and also contains code to delete files (the "Delete files" feature), which also is seen in ransomware. So to an antivirus, Picocrypt can look malicious, however, it is not, so please submit it as a false positive to help out everyone.

What file types can I encrypt?
You can encrypt any types of files with Picocrypt, there is no limitation.

Can I decrypt my files outside of Picocrypt?
No, you will need to use Picocrypt to decrypt any files encrypted with Picocrypt. This is because Picocrypt uses its own header format.

Can I change the extension of a Picocrypt volume?
No, please don't do that. Picocrypt volumes will typically look something like name.extension.pcv and when decrypting, uses the name.extension as the output. If you remove the extension and rename your volume to name.pcv, then Picocrypt doesn't know what the original extension is and will decrypt to name with no extension. So make sure you don't do that.

I want to help translate, how should I start?
Click here, which will lead you to the homepage document. To translate, simply copy everything into a text editor and replace all English strings with their equivalent in your language. When you're done translating, fork this repo and create a new file under translations and put your translated file there. Then, send a PR. If you don't know how to do that, feel free to just send me the document and I will take it from there.

Features

Will Picocrypt accept new features?
No, Picocrypt is considered feature-complete and won't be getting any new features. Unlike some other tools which try to constantly add new features and introduce new bugs and security holes, Picocrypt focuses on just a few features but doing each of them exceptionally well.

Does Reed-Solomon affect the speed of encryption/decryption?
It will only slow down your encryption speed under normal circumstances. If you decrypt a Reed-Solomon-encoded volume, it will decrypt at normal speed as long as there isn't any corruption. If there is corruption, however, Picocrypt will slow down significantly to rebuild the lost data. It will be slow, but remember, it's better to have your data back intact than not have it at all.

Windows

Picocrypt won't start. What should I do?
First, try using Picocrypt-NoGL.exe instead of the standard Picocrypt.exe. The standard Picocrypt.exe uses hardware-accelerated OpenGL for drawing the UI, but on systems that don't have OpenGL support, Picocrypt-NoGL.exe will use Mesa3D's software renderer instead.

macOS

I can't open Picocrypt because it's from an unverified developer!
Right click on Picocrypt.app and hit "Open". macOS will still not allow you to run Picocrypt, so right click on Picocrypt.app again and hit "Open", and you should get the option to run Picocrypt.

Linux

Should I use the .deb or AppImage?
I generally recommend the .deb over the AppImage and Snapcraft because it is the most "native" and will run with the best performance, reliability, and consistency. There are situations, however, where the AppImage may be appealing, such as a live operating system like "Tails", or on a non-Debian based distro like Fedora or Arch. The Snap is provided as a fallback if you are unable to install the .deb or run the AppImage, and should be avoided when possible.

Can I use Pico on live disk environments?
Yes, Picocrypt fully supports any Debian-based live distro such as Tails.

Potential data races for variables used by UI elements

On inspection I see a handful of potential data races. There are many cases where UI elements modify something in memory that may be simultaneously used by I/O related code (and vice versa).

For example stopShredding https://github.com/HACKERALERT/Picocrypt/blob/main/src/Picocrypt.go#L219 is bound to a UI action https://github.com/HACKERALERT/Picocrypt/blob/main/src/Picocrypt.go#L912 which will write to stopShredding in a different context than where it's consumed https://github.com/HACKERALERT/Picocrypt/blob/main/src/Picocrypt.go#L2174

Seems like most of the shredding related variables have this issue.

[Bug] App crashes in arch linux.

When dropping any type of file to picocrypt on arch linux it suddenly closes.

Virustotal hits

The exe gets 5 hits on virustotal. It would be useful to try to fix this.

Translation Issue

If you turn the page to a language other than English, go to the shredder tab, turn it back to English, and go back to the shredder tab, the last line on the bottom that says "Ready." in English will still be in the language it was set to

Also, every language except for Spanish has a "." after it's equivalent of "Ready."

1.20 Preview (not a bug)

Just an Issue so that I can upload a preview and get a reliable link. Not a real issue.
Picocrypt.zip

Decrypting to C:\Program Files\ does nothing → confusion (admin permission)

I'm currently testing Picocrypt because I like the idea and functionality behind this lightweight tool. I believe my rather "non-techy" perspective can be of value (in terms of expectations and workflow).

Environment

• Windows 10, 64bit
• Version 1.17 stable

Description of the issue

Decrypting a .pcv file located at C:\Program Files\Picocrypt to the same destination (probably anywhere in C:\Program Files\) does nothing if Picocrypt.exe isn't running with administrator permission.

This is not a bug, rather a Windows security feature. The user (not knowing this) might be confused because nothing happened; especially after getting the green Completed. message.

Possible solution

Is it possible to show a hint or even prompt the user to grant administrator permission when decrypting to a "protected" destination?

Add Localization Support

Not just for graphical user interface but also for encoding/characterset. As you may see in the screenshot below some letters (Turkish ones in my case) becomes to question marks.
Also, I want to conribute as a translator, so waiting for it.

Having ".pcv" anywhere in the file path/name breaks the application when encrypting.

If the string ".pcv" exists in the file name (for example: test.pcv.test.txt), the application silently fails to properly select the chosen file with no error message. If ".pcv" is in the path instead (for example: /home/user/test.pcv/testing.txt), the file can be selected, but the application throws an "unknown error" when the Start button is clicked.

Using simple file extension checks to determine whether to encrypt or decrypt works in a lot of cases, but is a bit fragile. A more robust method might be to silently include some non-encrypted metadata in any encrypted file, something the application can look for when a file is selected, that will tell Picocrypt if it's a compatible, encrypted file. Doing that would break the ability to encrypt a file twice... but I'm not sure how many people would need to do that. :)

Malware alert version 1.24

Kaspersky Anti-Virus: Trojan.Win32.Wofith.hqa
Picocrypt.exe
MD5: 5B7F59847E19C475FE2F89DAA98446FC

Webinterface for this tool?

I dont really know where to put a feature request so i will just post it here. What about a Webinterface for the tool? That way ot would not even require to be installed and would even work on Android. Of course there are some security flaws whith thus design(especially since the encryption would have to happen on a potentially compromised server) but it would still be nice to have over LAN.

Provide Filename Encryption as an Option

Those namings can be considered as metadata leakage and this is not matching with Picocrypt's ideology.

Extremely slow decrypt ?

Hello,

I was trying out Picocrypt, so I took a folder (2.3GB) and encrypted it with Picocrypt. I used the Reed Solomon feature since my goal is long term cloud storage.
Encryption was kinda slow, but I suppose that's normal considering that the tooltip on reed solomon warns you "slow).
Anyway, this is not an issue, it took about 10min to encrypt which is fine for me.

However, when I tried to decrypt said file (2.6GB after encryption with RS) it was very very very slow. The ETA was of 5 hours!

What's going on here? I don' think this behavior is normal/working as intended

Some info about me:

OS: Windows 10 Home 21H2 Build 19044.1586
CPU Intel(R) Core(TM) i5-1035G1 CPU @ 1.00GHz 1.19 GHz
RAM 8,00 GB
Picocrypt version 1.25

Even if in the screenshot you see the force decrypt option ticked, I first tried with the simple decrypt, but it was slow in the same way.
So, before opening this, I tried with the "force decrypt" option ticked hoping it would have speed up things.
However, no success.

Use "Telemetry" or similar wording instead of "Phones home" in comparison chart

I believe this would make things much more straight forward (and also there's not really an expression for this in Hungarian). Since telemetry is not necessarily a bad thing in IT and phoning home is a term that suggests slight malice and non desired effects there might be a better alternative for "Telemetry", though I still believe this is the most suitable, straight forward and simple word for this.

Any plans for a Android app?

Would love to install this as an .apk and encrypt on the go!

Doesn't start on Windows

If i try starting Picocrypt.exe (Version 1.11), i got this window:

So, the exe is just a .vbs file?

XChaCha20 Rationale

Hi,

This is an interesting project, I understand the need for it. But I'd like to know why XChaCha20 was chosen over AES. I'm as much of a Bernstein fan as the next person, but I see almost no fair reason for this - particularly given Picocrypt has at least some performance concerns (i.e., fast mode) and AES' ubiquity in hardware implementations. There's no question XChaCha20 is significantly slower AES, and likely incurs a greater performance penalty over large amounts of data than using SHA3 over Blake2b.

Thanks.

Add a Password Generator

A button right side of password entered area named "generate" would be pretty usefull.
Ideally I would suggest implement Bitwarden's generator.
And some optional checkboxes like "copy the generated password to the clipboard" or "remove the password from the clipboard after x time passed" or "save the generated password to a text file where the encrypted files will be located".

Feature request: Watch input folder for new files and encrypt any added files

I'd like to have a folder that I can throw files in, and they'll automatically get encrypted and moved to an output folder.

My use-case for this is encrypting text files with my 2FA backup codes, and then storing them in my nextcloud instance. I'd love if this could work using a public/private key implementation, but wouldn't mind if it popped up to ask for a password either.

[UI] Unable to see long paths in "Output" section of the UI

Hello,

If output file is long enough you are not able to see it completely
Maybe making that box horizontally scrollable could be a fix, but any solution would be fine

Below an highlighted graphical explaination of the issue:

Add tool tips for settings

Add tool tips for settings. For example a simple explanation of the reed solomon check box ect..

Text not fully readable in GUI / App does not adjust to Windows scaling

Text is overlapping at the “Advanced” section, and the window size is fixed, so I can't make it readable.
(See screenshot)

Windows 10, 1920×1080 screen resolution, scaling is at 125%. (So the app should/must adjust for the selected scaling of the Windows resolution.)

Feature Request: Command Line Support

I'm really liking this project and would like to switch over from 7zip to this for creating encrypted backups of our company data. I currently have an autohotkey script that generates a password and then creates an encrypted 7z file using the command line interface. Is there any plans of bringing this kind of functionality to Picocrypt in the future?

Thanks for the great work!

pcv file comments get cut off

When making an encrypted file, the option to put a comment (read-only) can be written without a length limit. but when you drag the pvc file to the picocrypt window, it gets cut-off.
For example, the comment "this message is going to be cut off because of the window" will only be readable to "~of the w"

Im on Windows, Picocrypt version 1.26

Windows Installer version (fix 7-Zip dependency)

Providing an installer for Windows solve the following problem:

The portable .exe can be detected as a virus, because it uses 7-Zip's self-extracting archive format to bundle Python along with Picocrypt

AUR package for Arch or AppImage

I have tried installing with snap in arch linux but it does not work. It will be interesting and arch package or an appimage.

Picocrypt 1.11 Broken .app file

Not sure if you're aware of this or not, but Picocrypt 1.11's download features a broken .app file.

1.10 works fine, however.

More transparency

I noticed Picocrypt tries to connect to the internet. It would be helpful to put this in the documentation and the reasons why.

Selecting all checksum boxes by default

Maybe it's because I'm still on 1.17, but when dragging a file into the checksum generator, it would be much easier if all of the boxes were checked by default. Otherwise, it's just a hassle when I drop a file in and none of the boxes are checked, which means I have to check the ones I want and then find the file again

[macOS] Download via AppStore

It would be awesome if this program can be downloaded at Apple AppStore so it can be used with „AppStore only“ setups.

Folder support

With #4 a context menu via right click can provide such a feature.

Removed SECURITY.md file

In the unlikely scenario that a security vulnerability is discovered, please draft a security advisory in the Security tab of this repository and I will fix it as soon as possible.

Only people with admin permissions can draft security advisories, which is why there should be a separate SECURITY.md file.