Right-click a folder on Windows 10 or 11 and choose “Encrypt with password”. The folder stays at its path, and the files in it are stored encrypted. To open it, double-click the lock icon inside and enter the password or use Windows Hello. When you lock the screen, the folder locks.
Version 0.1.0-alpha, not audited by a third party. Keep a backup of important data outside Zamok. Free, GPL-3.0.
Right-click the folder and choose “Encrypt with password”. The wizard asks for a password and offers a recovery key of 44 words.
Zamok writes an encrypted copy to a hidden folder next to it, checks the copy and only then deletes the original.
While the folder is locked, it shows one icon inside. Double-click it, and the password window from the top of this page opens. Windows Hello is turned on for each folder separately.
The folder locks by itself on Win+L, on sleep and hibernation, on sign-out and after 30 minutes without work in it. The timeout is set per folder. If files are open when the timeout comes, Zamok asks whether to lock now or postpone for 10 minutes.
Ctrl+Alt+Shift+L locks all folders at once.
Explorer copies the files to the new place unencrypted and deletes them from the vault. Lock the folder first: a locked folder has nothing to copy and stays where it is. Zamok cancels “Cut” on an encrypted folder and moving a parent folder to another drive. Windows offers no way to intercept dragging the folder itself. Other file managers do not see these checks.
User-Agent: Zamok/<version>; no cookies, identifiers, folder names or paths are sent, and nothing is downloaded. This was checked in the code of 0.1.0-alpha: core/Cargo.lock has no HTTP, TLS, socket or async network crates, zamok-core and zamok-shell.dll contain no sockets, HTTP clients or web addresses, and in Zamok.exe only the button handler calls the HTTP client. Details in PRIVACY.md.Zamok writes no decrypted data to disk itself. Windows and other programs leave traces. Encrypting the system drive (BitLocker or Device Encryption) covers almost all of them if the laptop is stolen.
| Where | What happens |
|---|---|
| Windows Search index | Files are marked “do not index” |
| Thumbnail cache | Explorer may store small copies of pictures on the system drive; this cannot be turned off for a single folder |
| Recent files | Shortcuts to the folder’s files are removed on lock; taskbar jump lists stay for now |
| Autosave and temporary files | Word, Photoshop and others write them to their own folders outside Zamok |
| Page file and hibernation file | Contents of open files may end up there. Zamok keeps its keys in memory that Windows does not page out, and before sleep and hibernation the folders lock and the keys are wiped |
| Recycle Bin | There is none: a file deleted from an open folder is gone at once |
An encrypted folder is a standard Cryptomator vault. If Zamok stops working or you uninstall it, the data stays in the hidden folder, and a note appears next to it:
vault.cryptomator from the hidden folder.Compatibility is tested in both directions against vaults made by Cryptomator 1.19.6. For the command line there is zamok-recover: it exports a decrypted copy with the password or the recovery key and is built from core/.
Without the password and without the recovery key, the data cannot be recovered. The recovery key is optional in the wizard and on by default.
| Property | Zamok | VeraCrypt | Cryptomator |
|---|---|---|---|
| Where you work with files | The folder at its own path | A container or partition mounted as a drive | A vault mounted as a virtual drive |
| Container size | Grows with the files | Fixed for file containers (dynamic containers exist) | Grows with the files |
| Encrypts the system drive | No | Yes | No |
| Hidden volumes | No | Yes | No |
| Platforms | Windows | Windows, macOS, Linux | Windows, macOS, Linux, iOS, Android |
| Folders in cloud sync | Refused for now | A container syncs as one file | Made for this case |
| Independent audit | None | Yes, of earlier versions | Yes, of earlier versions |
| Maturity | Alpha | Years of releases | Years of releases |
If you need an audited tool today, use VeraCrypt or Cryptomator. Zamok is written for one case: a folder that stays where it is and opens from Explorer.
Download Zamok-Setup-<version>.exe from Releases. The setup program contains the WinFsp driver and installs it only if WinFsp is absent. Windows asks for administrator rights for the driver. Zamok itself installs for your user account into %LOCALAPPDATA%\Programs\Zamok.
The installer is not signed yet. SmartScreen shows “Windows protected your PC”. Check the SHA-256 listed on the release page, then choose More info and Run anyway:
Get-FileHash .\Zamok-Setup-0.1.0.exe -Algorithm SHA256Smart App Control on Windows 11 blocks unsigned programs, so Zamok cannot be installed while it is turned on. On Windows 11 the Zamok items are under “Show more options” in the right-click menu.
Zamok has applied to SignPath Foundation for free code signing. Once the application is approved, release files are signed under this policy: free code signing provided by SignPath.io, certificate by SignPath Foundation. Committers and reviewers: olerast67. Approvers: olerast67. Every release is built by GitHub Actions from a tag in the repository and approved by hand before signing.
Privacy: this program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. The only such request is the “Check for updates” button, see PRIVACY.md.
Open items that matter for your data, all from the roadmap: no third-party review, no fuzzing of format parsing yet, power-loss tests on a virtual machine not done, Windows 11 and cloud clients not tested. Updates are checked only with the button in the settings, and nothing is installed automatically: you download the new version yourself and install it over the old one, which keeps your folder list.
How this was made: the author designed the app, directed the work and checked it on a real computer. Much of the code was written with an AI coding assistant (Claude by Anthropic). It has not been audited by a third party.
Found a vulnerability? Report it privately as described in SECURITY.md.