NCryptAES AES-256

The User Guide and Security Review, Played Out. Lock Text, Files and Folders Behind a Shared Secret, on Your Own Machine.

User Guide v0.8.4 · Security Review rev 2.5
Both revised 14 September 2026
macOS · Windows · Linux

01 / 14

Quick Reference

The Shared Secret

Length	12 to 64 characters
Encrypting	Type it twice; both must match
Decrypting	First field only
Stored on disk	Never
If you lose it	The data can’t be recovered

Picking One

Several unrelated words, such as violet-anchor-ceramic-tuesday, or a long random passphrase from a password manager.
Never one you use elsewhere. Avoid names, dates and single dictionary words.
Share it over a different channel from the encrypted data, and keep a copy apart from it.

Menus and Shortcuts

Edit ▸ Copy Cipher Text to Clipboard	—
Edit ▸ Copy Clear Text to Clipboard Asks first, clears after 30 s	—
Cut / Copy / Paste / Select All	`⌘/Ctrl` X C V A
Actions ▸ New Instance	`⌘/Ctrl` `N`
Help ▸ About	—

Under the Hood

AES-256-CBC with PKCS7 padding, PBKDF2-SHA256 at 800,000 iterations, a separate HMAC-SHA256 key, Encrypt-then-MAC with constant-time verification, and a fresh 16-byte salt and IV every time. No network calls, no telemetry, no accounts.

Limits

Files and folders up to 1 GB once compressed. Speak works on macOS and Windows, not Linux.

Status Messages

Please Input a Shared Secret of 12-64 Characters …	Secret too short or too long.
Shared Secret and Confirmation Must Match …	Retype it carefully in both fields.
Decryption Failed: Wrong Secret or Corrupted / Tampered Data …	Check the secret, and that the whole block was pasted.
… is Too Large to Encrypt: The Limit is 1 GB Once Compressed …	Split it and encrypt the parts.
… Contains an Unsafe Path and Was Not Restored …	Refused for your safety. Only decrypt files from people you trust.
Secret and Text Cleared After Inactivity …	The five-minute idle timer fired. Start again.

Best Practice

Keep the whole cipher text block. A clipped block can’t be decrypted.
Check you can decrypt a file before you delete the original.
Encrypting doesn’t remove the original. Delete originals you no longer need.
Turn on FileVault, BitLocker or LUKS so temporary data is protected too.
Lock your screen when you step away, even with the idle clear-down.
Avoid copying plaintext, and turn off cross-device clipboard sync for confidential work.
Keep your OS and NCryptAES up to date, and download it only from its official source.

Licence

NCryptAES is free and every feature works without a licence. Request one at licenses.choltech.com, put the .lic file in the same folder as the app, and restart.