Your files live
on your disk, nowhere else
SealDisk is a local, offline encrypted virtual disk. Unlocked, it's an ordinary drive that any app can read and write. Locked, it's just a file that can't be told apart from random data. No cloud, no account, no networking code.
Use it like a disk,
trust it like a safe
Once unlocked, SealDisk mounts the container as a system drive. Finder, Office and Photoshop open and save directly. No decrypt, edit, re-encrypt routine.
Unlock to mount
Enter your password and the vault appears with your other disks: under ~/SealDisk on macOS, as a drive letter on Windows. Every app reads and writes transparently. Lock it and the volume vanishes with no cached files left behind.
Built-in file browser
Import, export, preview text and images, create folders, rename and delete without mounting anything. Works even before WinFsp or macFUSE is installed.
Auto-lock
Locks on idle timeout, system sleep, screen lock or user switch, unmounting the volume and wiping keys from memory. The countdown is always visible, so you never forget.
Recovery phrase
A 24-word recovery phrase gets your data back if you forget the password. Input tolerates case and spacing, and errors tell you which word is wrong.
Panic password and emergency destroy
Set a panic password: entering it under duress instantly erases the master key and makes the container unrecoverable. Or press ⌘ ⇧ ⌥ ⌫ at any time to trigger emergency destruction. Shred delete overwrites twice before removing a file.
Screen-capture protection
On Windows, screenshots, screen recording and PrintScreen get a black box. On macOS the window is hidden from third-party recording and window-capture tools.
Export protection Pro
When enabled, file managers and unauthorized processes cannot copy or drag data out of the volume. Only the apps you allow can read its contents. Fully effective on Windows; on macOS it does not cover Finder (see limitations).
Disguise mode Pro
Strips every plaintext marker so the container is random bytes from start to end. Use any extension. Nobody can prove it's an encrypted container.
Hardware binding Pro
Optionally seal the device key in the Secure Enclave or TPM so the container opens only on this machine. A copy taken elsewhere is useless.
Encrypted audit log Pro
Unlocks, mounts, password changes and policy denials are recorded, encrypted and chained with HMAC, so tampering and truncation are detectable. File names appear only as hash fragments.
Built for files that must not leak
SealDisk fits anywhere you keep sensitive files on a computer you share, carry around, or don't fully control.
Contracts, finances and client data
Freelancers and small teams keep contracts, spreadsheets and client lists in one vault: mount it when working, lock it when leaving. Nothing sensitive sits in plain sight on the disk.
Private files on a shared computer
Keep personal photos and documents on a family or office machine without anyone browsing or copying them. Locked, the vault is one opaque file; auto-lock covers the moments you forget.
Laptops that travel
Bind the vault to your machine's Secure Enclave or TPM so a copied or stolen file is useless elsewhere, and keep a panic password for the worst case. Hardware binding is a Pro feature.
Encrypted backups on cloud drives and USB sticks
A vault is a single file, so it goes onto iCloud, Dropbox, OneDrive or a USB stick as-is. The sync service only ever sees ciphertext. Create it on a Mac, open it on Windows.
Three steps to start
Create a vault
Pick a location and size, set a password. Vaults can be fixed-size or grow on demand, and deleting files really gives disk space back.
Unlock and mount
Enter your password, or the 24-word recovery phrase. Within seconds the vault appears as a disk with the volume name you chose.
Work as usual
Open, edit and save in any app. When you're done, click Lock, or do nothing and let it lock itself.
An open design,
promises you can check
We don't say "military-grade encryption". Here are the actual algorithms and parameters SealDisk uses, so you can verify each one.
- Nonces are never reused. Each data block's nonce combines a random container prefix with a monotonic write counter that never rolls back, even after a power loss.
- Changing the password doesn't rewrite data. The master key is wrapped by a KEK derived from your password. A password change only rewraps it, so a 20 GB vault takes a second.
- Keys are protected in memory. Sensitive buffers are locked in RAM, kept out of swap and zeroed the moment they're no longer needed. Release builds disable core dumps.
- Redundant header. The 4096-byte header is stored twice. If either copy is damaged, the other restores it.
- Screen-capture protection. The app window is invisible to screen recording and screenshot tools, so nothing leaks when you share your screen in a meeting.
AES-256-GCM, 16 KiB blocks, 12 B nonce + 16 B tagArgon2id (default 256 MiB, 3 passes) → KEK → unwraps master key MKHKDF(MK) → HeaderKey / DataKey / MapKeyPassword · Recovery key · Device key · Panic password.vault v1, 4096 B header stored twiceOpenSSL 3, statically linkedNone. The binary contains no networking codePassword
Argon2id derives the KEK, with parameters tuned to your machine.
Master key MK
Wrapped by the KEK and stored in a key slot. Any of the four slots unwraps the same MK.
Data keys
Derived with HKDF. Header, data and allocation map each use their own key.
SealDisk vs VeraCrypt, Cryptomator and full-disk encryption
Each of these tools is good at something. Here is where they differ, so you can pick the right one or combine them.
| SealDisk | VeraCrypt | Cryptomator | FileVault / BitLocker | |
|---|---|---|---|---|
| How you use it | Mounts as a normal drive; native macOS and Windows apps | Mounts as a drive; technical interface with many options | Mounts as a drive; designed for cloud sync | Always on for the whole disk; nothing to mount |
| What's on disk when locked | One file, indistinguishable from random data | One file, indistinguishable from random data | A folder of individually encrypted files; file count and sizes are visible | The disk itself, open to anyone who is logged in |
| Forgot the password | 24-word recovery phrase, offline | No recovery; the data is gone | Recovery key | Recovery key held by you or your account |
| Under duress | Panic password wipes the master key; emergency-destroy hotkey | Hidden volumes for plausible deniability | None | None |
| Offline, no account | Yes; no network code at all, license activation is offline too | Yes | Yes for the desktop app | Yes, built into the OS |
Based on each product's public documentation as of September 2026; all of them keep evolving, so check their official pages. Full-disk encryption protects a powered-off machine and complements a vault rather than replacing it.
Core features free forever, four Pro features by subscription
Not a trial. Create and use as many vaults as you like for free, with no time limit and no sign-up. Pro adds four features for people who need them.
Free
Forever. Unlimited vaults, no registration.
- Create and mount vaults, unlimited
- Auto-lock on idle, sleep, screen lock and user switch
- 24-word recovery phrase
- Panic password and emergency destroy
- Shred delete
- Built-in file browser
- Screen-capture protection
Pro Pro
Unlocked with an offline license key. Your vaults stay yours whether or not you renew.
- Disguise mode
- Hardware binding (Secure Enclave / TPM)
- Export protection (fully effective on Windows)
- Encrypted audit log
- The key is bound to one machine, activated offline, with no account
- Free means freeCore features are free forever with no time limit. This is not a trial version.
- Expiry never locks your dataWhen a subscription expires, the vaults and data you already have are completely unaffected. Existing disguised and hardware-bound vaults open and read and write as before, export protection you switched on stays on, and audit logs remain readable and verifiable. Expiry only stops you creating new vaults with Pro features or switching Pro options on. The licence system never takes part in key derivation — that is an architectural commitment, not a policy choice.
- Activation is offlineActivation is entirely offline. The machine code is an irreversible digest of your motherboard identifier: it carries no personal information and is never uploaded. The licence is verified against a public key built into the app, with no network request at all. Changing memory, disks or reinstalling the OS won't invalidate it; a motherboard swap needs a re-issued key, free within the subscription year.
Free download, no sign-up
The macOS build is Developer ID signed and notarized by Apple. The Windows build is portable: no installer, no admin rights. Mounting a vault as a drive needs a file system component, described below.
macOSVersion 1.2.0 · Apple Silicon
- macOS 26 and later: nothing else to install. The built-in file system extension mounts vaults; switch it on once in System Settings.
- macOS 13 to 15: install macFUSE to mount vaults as a drive.
- Without mounting you can still import, export and preview files in the built-in browser. Intel Macs are not supported yet.
WindowsVersion 1.2.0 · x64 and ARM64
- Windows 10 (2004+) and 11. Single-file portable .exe: double-click and go, no installer, no admin rights.
- To mount vaults as a drive letter, install WinFsp (open source). Without it the built-in file browser still works.
- Native x64 and ARM64 builds. Vault files are interchangeable with macOS. An MSIX installer will follow once we have a code-signing certificate.
SHA256 checksums for every download
What it can't do, stated plainly
The most dangerous thing a security product can do is make you feel protected when you aren't. These are the scenarios SealDisk explicitly does not promise to cover.
Allowed apps can take data out
Export protection only controls which processes may read the volume. Once an app is allowed to open a file, it can Save As elsewhere, copy to the clipboard or upload it. Only allow apps you trust.
Shredding on SSDs isn't physically guaranteed
SSD wear leveling, APFS snapshots and Time Machine backups may retain old copies. Turn on FileVault or BitLocker full-disk encryption as well.
Failed-attempt lockout only works locally
An attacker who obtains the container file can try passwords offline with their own tools. The real defense is the Argon2id parameters and a long password.
Export protection on macOS does not cover Finder
macOS's FSKit does not tell a file system which process is asking, so on macOS export protection cannot stop Finder from copying files. It is fully effective on Windows. Check this before buying Pro; macFUSE in kernel-extension mode is the workaround on macOS.
4 GiB single-file limit
The in-vault file system is currently FAT-based: a single file is at most 4 GiB, and names can't contain \ / : * ? " < > |. A future release will replace it with our own file system while keeping the container format compatible.
Print protection doesn't cover third-party apps
The built-in image, PDF and text viewers have no print function, but nothing stops a third-party app you allowed from printing.
Questions you might have
What if I forget my password?
If you generated and saved the 24-word recovery phrase when creating the vault, use it to unlock and set a new password. Without either, nobody can open the vault, including us. That's by design, not an oversight.
What happens when a Pro subscription expires?
Nothing happens to your data. Every existing vault opens and works exactly as before, including ones that use Pro features. You only lose the ability to create new Pro-feature vaults or switch on new Pro options, and the audit log pauses after a 3-day grace period. Core features stay free forever.
How do I activate Pro?
Three steps, all offline: copy your machine code from Settings → License in the app (it looks like W-4K7M-2QP9-XB3T-H6ZR); send it to us when you buy; paste the licence text you receive back into the same page and click Activate. No account, no network request. The License page ships from version 1.2.0.
How is SealDisk different from VeraCrypt?
Both create encrypted containers that look like random data and mount as a drive. SealDisk trades VeraCrypt's many options for a native macOS and Windows app with things VeraCrypt lacks: a 24-word recovery phrase, a panic password and emergency destroy, auto-lock, screen-capture protection and a built-in file browser. VeraCrypt offers hidden volumes and Linux support and is fully open source. The comparison table above has the details.
Can I keep the vault file on iCloud, Dropbox or an external drive?
Yes. The vault is an ordinary file, and sync services only ever see ciphertext. Sync it while locked; syncing a mounted vault can produce conflicting copies. Never mount the same vault on two computers at once.
Do I need to install anything to mount a vault?
On macOS 26 and later, no: SealDisk ships its own sandboxed file system extension, and you switch it on once in System Settings. On macOS 13 to 15 install macFUSE; on Windows install WinFsp. Both are open source and their licenses do not allow us to bundle them. Without either, the built-in file browser still lets you import, export and preview files.
Is the Windows version really portable?
Yes. The single-file .exe needs no installer and no administrator rights; on first launch it unpacks into your local app data folder. A .zip folder version is also available. Only WinFsp, needed to mount vaults as a drive letter, is a separate system install.
Does SealDisk connect to the internet?
No. There is no networking code in the program: no telemetry, no update checks, no account. Pro licences are verified offline as well — the key is checked against a public key built into the app, with no network request at all. You can verify this with a firewall.
Do vaults work across macOS and Windows?
Yes. Both platforms share the same C++ core and container format, so one .vault file opens on either.
How does disguise mode make a vault "indistinguishable"?
A normal vault carries a short plaintext marker that tells the app it's a SealDisk file. Disguise mode removes it; the key derivation parameters come from a tier number you choose, so every byte from first to last is ciphertext or random padding. To open one, you tell the app it's a disguised vault and pick the tier.
Lock away what matters
Core features free forever, offline, no account. Create your first vault within a minute of downloading.
Download SealDisk 1.2.0