TrueVault
Private file vault

Nobody looks twice at a notes app.

Real notes on the outside. An encrypted vault behind a long press. No account, no ads, and nothing about your files ever leaves the phone.

0files uploaded
2permissions
4.13 MBdownload

Swipe to see it open

Try it — hold the title

Locked, there is nothing to find.

While the vault is closed its tabs are not greyed out — they are gone. A disabled tab would tell whoever is holding your phone exactly what this app is.

The part people ask about

Delete it from your gallery.

The vault keeps its own encrypted copy — a different file, not a shortcut. Your original stays where you left it, and nothing in the app can remove it.

EncryptStreams into a sealed container
VerifyRead back, every tag checked
CommitOne atomic rename
DoneYour original untouched
Under the hood

Real cryptography, not a hidden folder.

AES-256-GCMChunked, a separate key per file, every chunk bound to its position
Argon2id32 MiB, 4 passes, per-vault salt
Sealed twiceBy your password and by the hardware keystore
6-digit PIN≈ 28 years to guess against the built-in delay
01It cannot make the app invisible — Android Settings still lists it.
02Lose the password and the recovery key and the vault is gone. Nobody can reset it.
03No independent security audit has been performed.
Free · Works offline

Put it on your phone.

v0.2.0 · 4.14 MB · Android 8.0 and newer · no ads, no purchases, nothing to sign up for.

VK Vansh KashyapCo-founder, LZ Worth · New Delhi · 8 products shipped

Open source · Privacy Policy · vk1234888i@gmail.com

Android · Free · No account

Nobody
looks twice
at a notes app.

That is the whole idea. TrueVault opens to real notes — write them, tick them, search them. Hold the title for two seconds and your encrypted vault asks for a password.

Watch it open
0files uploaded
0ads or trackers
2permissions
4.13MBdownload

Press and hold the title

The cover

Locked, there is
nothing to find.

While the vault is closed the vault tabs are not greyed out — they are gone. A disabled “Vault” tab tells whoever is holding your phone exactly what this app is, which is the one thing a cover exists to prevent.

A notes app that actually works

  • Write, pin, colour, search. Checklists you can tick straight from the grid without opening the note.
  • Notes have their own database. Nothing in the notes half can reach the vault — that is a dependency graph, not a promise.
  • Auto-lock returns here, never to a password prompt that announces there is something worth protecting.

Two ways in, both need your password

  • Press and hold the title. The gesture opens the password screen — it never opens the vault.
  • Settings → Open Private Vault. The visible route, so forgetting a gesture can never lock you out of your own files.
  • Change the launcher icon to Nexa, Nexa Notes or Nexa Files if you want a different name on the home screen.
The part people ask about

Delete it from your gallery.
The vault keeps its copy.

Adding a file encrypts a separate copy into the vault. Not a shortcut, not a reference, not a hidden folder — a different encrypted file. Your original stays exactly where you left it, and nothing in the app can remove it.

Encrypt

Your file streams through encryption into a temporary container. Nothing outside the app has been touched.

Verify

The container is read back and every authentication tag checked. A copy that cannot be opened is never committed.

Commit

An atomic rename. From that instant the vault item either exists complete or does not exist at all.

Done

Your original is untouched. Delete it later, keep it, move it — the vault copy is unaffected either way.

What you get

Your files stay
on your phone.

Encryption, decryption and every file operation happen on the device. Nothing is uploaded, and there is nowhere for a file to go.

Encrypted vault

AES-256-GCM, a separate key per file. Containers are named with random identifiers, so the folder itself reveals nothing.

30-day trash

Deleting a vault item moves it, never erases it. Restore is one tap for a month, so a mis-tap costs you nothing.

Leak scanner

Point it at a folder and it finds copies of files you already secured, by size and content hash — and states what it cannot see.

Share from anywhere

TrueVault sits in the Android share sheet for every file type. Share from your gallery, a chat, a download — it asks for your password and imports.

A limit you set

Give the vault 500 MB, 20 GB or no ceiling at all. It limits what comes in — nothing already stored is ever removed to make room.

Encrypted backup

Export an archive and restore it into a brand-new vault with a different password. Every item still opens — the keys are re-wrapped on the way through.

Fingerprint or PIN

4-digit, 6-digit or a passphrase, with a growing delay after failed attempts. Android does the biometric check — the app never receives it.

Works on a plane

No sign-in, no email, nothing to create. Every feature works with no connection at all.

The uncomfortable part

What it cannot do.

Every privacy app promises the world. Someone may lean on a feature like this in a situation that genuinely matters, and a promise the app cannot keep would put them at risk. So here is the list — the same sentences the app shows on the screens where each choice is made.

01It does not make the app invisible. Android Settings, storage and battery screens list it under its real name.
02It cannot protect a rooted or already-compromised phone.
03It cannot reach copies of your files it has no access to — other apps, chats, cloud accounts, another device.
04A 4-digit PIN is weak. The app says so on the screen where you pick it.
05Lose your password and your recovery key and the vault is gone. No account, no reset email, no support route back in.
06No independent security audit has been performed on this app.

And one thing to do today

Everything lives on your device and nowhere else, which is the point — and it also means uninstalling removes your vault. Export an encrypted backup and keep it somewhere you will still have in a year.

The source is public, so none of this has to be taken on trust: read the code.

Questions

Straight answers.

If I delete a photo from my gallery, does it vanish from the vault?

No. The vault holds its own encrypted copy — a different file, not a reference. Delete the original, move it, edit it: the vault copy is unaffected.

Does anything get uploaded?

Not your files — not their contents, names, number or size. The app does contact a server once when it starts, and sends three things: an install identifier, the name you typed on first launch, and the app version. That is so a specific install can be suspended or given extra features. There is still no account and no sign-in, and the app works fully offline.

Can it hide itself completely?

No, and any app that says otherwise is lying to you. You can change the launcher icon and name, but Android Settings, storage usage and permission screens still list it under its real package. Anyone who looks there will find it.

What if I forget my password?

Your recovery key is the only way back in, and the only credential that works on a different phone. Lose both and the vault cannot be recovered by anyone — not by you, not by the developer. That is a design property, not a support limitation: there is nothing on any server to reset.

Who made TrueVault?

Vansh Kashyap — an independent web, mobile and AI automation developer in New Delhi, India, and co-founder of LZ Worth. His portfolio is at vanshkashyap.lzworth.in and his technical work at techbyvansh.lzworth.in. There is a fuller developer page here.

Why is it not on the Play Store?

It is a solo project and this is an early build — the legal documents still carry placeholders, which the app itself tells you on first launch. Download the APK and Android will warn you before installing. That warning is doing its job.

Is my fingerprint stored?

No. Android performs the check and returns a yes or no. The app never receives your fingerprint or face data, only a handle to a key the system will unlock after a successful check.

Under the hood

The details.

File encryptionAES-256-GCM, chunked, a separate key per file. Each chunk is bound to the file header, its own index and an is-last flag, so truncation, reordering and splicing all fail the tag.
PasswordArgon2id, 32 MiB and 4 passes, with a per-vault salt.
Key storageSealed twice — once by your password, once by a key in the device's hardware-backed keystore. Useless without your password, and useless on another device.
Recovery key24 characters, about 118 bits, generated by rejection sampling so no character is likelier than another.
4-digit PINAround 104 days on average to guess against the built-in delay. Measured, not estimated.
6-digit PINAround 28 years on the same basis.
PermissionsTwo: USE_BIOMETRIC and INTERNET. No storage permission, no all-files access, no location, no camera, no microphone.
AnalyticsNone, and no crash reporter. Nothing about what you do in the app is recorded.
Android backupDisabled, so your vault is never swept into a system backup you did not ask for.
RequiresAndroid 8.0 (API 26) or newer
Who made this

One developer,
no company behind it.

VK

Vansh Kashyap

Co-founder, LZ Worth · Web, Mobile & AI Automation Developer · New Delhi, India

Building and shipping since 2023, with eight products live across Android, Windows and the web — StreamGarden, JanamJyot, Hisaabi, RealtyResolve and others. He works full time at Grivaa Capital and co-founded LZ Worth, which builds websites, React applications and n8n automation systems for founders, creators and service businesses.

TrueVault is built solo: the architecture, the cryptography, and the wording of every warning. There is no funding to answer to, which is exactly why the app can afford a page listing what it cannot do.

KotlinJetpack Compose ReactNext.js TypeScriptSupabase n8nTechnical SEO
Full profileAbout the developer
Portfoliovanshkashyap.lzworth.in
Technical worktechbyvansh.lzworth.in
SourceObitouchiha002/truevault
Email & privacy contactvk1234888i@gmail.com
Free · No account · Works offline

Put it on your phone.

Install it, write a note, and hold the title when you are ready.

v0.2.04.14 MBAndroid 8.0+Signed