VANTALOCK

The Zero-Cloud Encrypted Vault

Military-grade AES-256-GCM encryption derived via Argon2id. Passwords, bank details, contracts, and confidential documents stay strictly on your local hardware.

Download for Windows Download for macOS Download for Linux

Encrypted Vault Storage Suites

VantaLock provides three dedicated, isolated vault compartments designed to categorize and shield all aspects of your digital life.

Financial Vault

AES-256-GCM Isolated

Comprehensive offline protection for high-value monetary credentials, banking assets, payment methods, and cryptocurrency recovery keys.

Uploadable & Storable Assets:

Bank account numbers, SWIFT/IBAN & routing codes
Credit / debit cards with encrypted CVVs & PINs
Crypto wallet seed phrases, private keys & hardware backup codes
Loan agreements, tax records & statement PDF attachments

Legal Vault

Zero-Knowledge Encrypted

Sovereign cryptographic storage for binding agreements, property deeds, personal identification, and privileged legal documentation.

Uploadable & Storable Assets:

Contracts, Non-Disclosure Agreements (NDAs) & corporate filings
Real estate title deeds, leases & property registrations
Passports, driver licenses, birth certificates & SSN/Tax IDs
Wills, estate planning documents & power of attorney records

Personal Vault

Local Sovereign Storage

Your private digital sanctuary for personal accounts, secret keys, confidential notes, identity backups, and sensitive media files.

Uploadable & Storable Assets:

Account passwords & multi-factor authentication (2FA) recovery seeds
Private journal entries, creative IP & personal correspondence
Medical records, health insurance details & prescription history
Encrypted photo & document file attachments

Cryptographic Architecture

VantaLock utilizes mathematical defense-in-depth to eliminate single points of failure and guarantee privacy.

What is AES-256-GCM and How It Works

AES-256-GCM (Advanced Encryption Standard with 256-bit key in Galois/Counter Mode) is the gold standard for authenticated symmetric encryption used by governments and high-security institutions worldwide.

256-bit Key Length: Provides 2^256 possible key combinations, making brute-force attacks physically impossible with current and foreseeable computing power.
Authenticated Encryption (GCM): Unlike standard AES modes, Galois/Counter Mode calculates a 128-bit authentication tag alongside the ciphertext. Any tampering, bit-flipping, or data corruption is detected immediately before decryption is attempted.
Unique Initialization Vectors (IVs): Every single entry and file attachment is encrypted with a fresh, random 96-bit IV, ensuring duplicate plaintexts generate completely different ciphertexts.

Key Derivation via Argon2id

Your master password is never stored anywhere on disk or in the cloud. Instead, VantaLock uses Argon2id (winner of the Password Hashing Competition) to derive the 256-bit AES key on demand.

Memory-Hard Execution: Configured with 64 MB of RAM allocation per derivation to defeat GPU and ASIC accelerated cracking attempts.
Cryptographic Salt: Combined with a 128-bit random salt stored locally to completely eliminate pre-computed rainbow table attacks.
RAM Isolation: The derived key lives exclusively in RAM during your session and is instantly purged on lock or sleep.

Encrypted Local Backups & RAM Protection

Your data security extends through the full lifecycle of your session, ensuring zero remnants remain when the vault is locked.

Local JSON Export & Import: Easily backup your entire encrypted vault to an offline USB or external hard drive. Backups remain fully encrypted with your master key.
Auto-Lock & Clipboard Scrubbing: Inactive sessions automatically lock and derived keys are zeroed out in memory. Sensitive items copied to the clipboard are purged automatically after 30 seconds.

Onboarding & Zero-Cloud Guarantee

Designed for users who demand full data sovereignty without trusting remote cloud infrastructure.

Phase 01

License Activation

Enter your Lemon Squeezy license key once. This one-time activation is the only network request VantaLock will ever make.

Phase 02

Master Key Creation

Establish your master password with real-time entropy validation. VantaLock never saves your password or key.

Phase 03

24-Word Recovery Seed

Generate and confirm a standard BIP-39 recovery phrase. This seed is your sole recovery option if you lose your password.

Installation Guide

Simple, straightforward installation across all major desktop platforms.

Windows

Windows Installer (.exe)

Click "Download for Windows", open `VantaLock-Setup.exe`, follow the setup wizard, and launch VantaLock from your desktop or start menu.

macOS

macOS Disk Image (.dmg)

Click "Download for macOS", open `VantaLock-Mac.dmg`, drag the VantaLock icon into your Applications folder, and launch instantly.

Linux

Linux AppImage (.AppImage)

Click "Download for Linux", make `VantaLock-1.1.30.AppImage` executable with `chmod +x`, and launch directly.

Platform Specifications

Lightweight, standalone desktop software engineered for minimal system footprint.

Operating System	Architecture	Min. RAM	Disk Space	Security Features
Windows 10 / 11 (64-bit)	x86_64 / x64	512 MB	150 MB	DPAPI Encrypted Keyring, ASLR, DEP & Integrity Enforcement
macOS 11.0+ (Big Sur / Monterey / Ventura / Sonoma / Sequoia)	Apple Silicon	512 MB	180 MB	Keychain Integration, Hardened Runtime & App Sandbox Isolation
Linux Ubuntu, Fedora, Debian, Arch & Tails	x86_64 / ARM64	512 MB	120 MB	Secret Service API / KWallet Support, Memorylock (mlock) Memory Hardening

Hardware & Kernel Memory Isolation

Low-level OS protection mechanisms enforcing zero-trace memory security.

VantaLock's runtime engine enforces low-level operating system protection mechanisms across all desktop platforms to maintain absolute data integrity and prevent unauthorized memory inspection:

RAM Memory Lockdown (mlock / VirtualLock): Key derivation buffers created via Argon2id are explicitly pinned in physical RAM memory using system calls to prevent sensitive cryptographic material from being written to unencrypted swap space or paging files.
Zero-Trace RAM Scrubbing: Master keys and temporary AES-256-GCM cipher contexts are active strictly during operation and are deterministically overwritten with cryptographically random bytes before memory deallocation.
Air-Gapped Operation: Designed to run seamlessly in completely offline, network-isolated environments (including live USB operating systems like Tails or Qubes OS) with zero external library or runtime network calls.

About VantaLock

Local-First, Zero-Cloud Data Sovereignty

What is VantaLock?

VantaLock is an independently developed desktop vault application engineered to give individuals complete ownership over their sensitive data. Built on a strict zero-cloud architecture, VantaLock ensures that your files, credentials, and encrypted compartments reside exclusively on your local hardware.

Our Philosophy & Architecture

Modern cloud services expose private data to third-party server breaches, forced updates, and continuous telemetry tracking. VantaLock eliminates these vulnerabilities by running completely offline. All vault encryption is performed locally using military-grade primitives—including AES-256-GCM authenticated encryption, Argon2id password hashing, and standard 256-bit BIP-39 mnemonic key generation.

Operator & Development

VantaLock is engineered, maintained, and operated by an individual developer as an independent software security project dedicated to user privacy and digital sovereignty. The codebase is open for public inspection on GitHub, ensuring full cryptographic transparency without hidden tracking scripts, remote backdoors, or analytics collection.

Direct Developer Support Email: support@vantalocksecure.com

Frequently Asked Questions

Clear answers about security, storage, recovery, and platform operations.

What if I lose my password or recovery seed?

If you lose both your master password and your 24-word recovery seed, your data is permanently lost. Because VantaLock runs completely offline on your device, there are no password reset links, backdoors, or support overrides to help you regain access. Always save your 24-word recovery seed offline before storing sensitive files.

Where is my encrypted vault file stored on my disk?

VantaLock stores your encrypted vault file locally in your operating system's standard application data directory. You can open your local vault directory quickly using OS keyboard shortcuts:

Windows: Press Win + R, paste %APPDATA%\vantalock, and press Enter.
macOS: Open Finder, press Cmd + Shift + G, paste ~/Library/Application Support/vantalock, and press Enter.
Linux: Press Ctrl + Alt + T to open terminal, then run cd ~/.config/vantalock or open file manager to ~/.config/vantalock.

Can VantaLock run completely offline?

Yes. Beyond the brief 1-time license activation check upon initial launch, VantaLock requires zero internet connectivity and can operate indefinitely in air-gapped environments.

Can I use my license on multiple devices?

No. Each license key is strictly bound to a single device hardware installation at a time. To run VantaLock on a different computer, you must transfer your license. Attempting concurrent activation on multiple machines will invalidate the key.

What happens if I reinstall VantaLock or switch computers?

Reinstalling VantaLock on the same machine does not affect your stored data because your encrypted vault file lives independently in local operating system application storage. To switch computers, follow these steps:

Copy the vault file from the old computer's local storage (see storage location FAQ above) to a USB drive or external storage
Install VantaLock fresh on the new computer
Place the vault file in the new computer's equivalent storage location
Deactivate the license on the old device and activate it on the new one via the Lemon Squeezy portal

What information does the license activation check send?

The initial 1-time activation check transmits only your purchased license key string and an anonymous hardware device fingerprint. No personal identity details, vault contents, passwords, or telemetry data are collected or transmitted. This check connects directly to Lemon Squeezy's secure API.

Can I export or migrate my data to another password manager?

No. VantaLock exports encrypted local JSON backups specifically for restoring VantaLock vaults. Due to custom zero-knowledge AES-256-GCM encryption and specialized multi-vault compartment schemas, exports are not directly compatible with third-party password managers like 1Password or Bitwarden.

How do I update VantaLock?

Updating VantaLock is simple and preserves your existing encrypted local vault data. Follow these steps:

Download the latest installer package for your operating system from our landing page or official GitHub Releases page
Completely close any running instance of VantaLock on your desktop
Run the new installer executable (.exe on Windows, drag new .dmg to Applications on macOS, or overwrite .AppImage on Linux)
Launch VantaLock — there is no need to repeat onboarding or re-enter your license key, as all local application data remains preserved on your PC and will automatically load.

Optionally, you can simply open the About section in your VantaLock desktop app and click "Check for Updates on GitHub".