The command
Free and open. Create a vault, enroll a key, and keep the recovery code. The source is public, so the lock can be audited.
github.com/deltreexyz/wardletHardware-key encryption for Linux
Encrypt files where they are.
A FIDO2-compatible key unlocks them. Wardlet does not upload your files, and it does not mount a drive.
See the product Supported devices Download
Vaults and keys work. File encryption is in progress. A packaged download is coming soon.
The product
One way to lock a file. The command is free. A desktop app comes later, and it opens the same files.
The files
An encrypted copy sits beside the original. SSH keys, notes, and environment files stay in the directory you chose.
What’s next
A desktop app for people who do not want a terminal. It is a window onto the same vault. The command remains a way to open the files.
Features
Built for a person with a hardware key, not for a cloud account.
Files stay put
No mounted drive and no container. You delete the plaintext yourself once the ciphertext opens.
A key you already own
YubiKey, Trezor, and other FIDO2 keys. Touch the key. The PIN, when there is one, is the website PIN.
Several keys, one lock
Any enrolled key opens the files. Adding a key does not rewrite them.
A recovery code, shown once
The way back in if every key is lost. Wardlet does not keep a copy. Store it in a password manager.
Nothing calls home
The vault is a directory on your machine. Copying it does not copy a way to open the files.
An open format
Files are age ciphertext. You are not locked to a program that only Wardlet can read.
Supported devices
Plug the key in with USB. If it asks for a PIN, that is the same PIN a website asks for.
Enrolled with Wardlet
- YubiKey 5 Tested. Includes the 5 NFC.
- Trezor Safe 3 Tested. The PIN is entered on the device.
Same kind of key
- Other YubiKey 5 models 5C, 5C NFC, 5Ci, 5 Nano, and the FIPS variants. Firmware before 5.2 cannot unlock a vault.
- Trezor Safe 5 and Model T Same support as the Safe 3. The PIN is entered on the device.
- Nitrokey 3 USB. Not the Nitrokey FIDO U2F, Start, Pro, or Storage models.
- SoloKeys Solo 1 Solo, Solo Hacker, and Solo Secure.
Not compatible
- YubiKey 4, YubiKey NEO, original Security Key Older login keys. They cannot unlock a Wardlet vault.
- Trezor One Website login only. It cannot unlock a Wardlet vault.
One lock, several keys
Lose a key without losing the files. Keep a second key, and a recovery code for the day both are gone.
Create a vault
Wardlet enrolls the first key and shows a recovery code once.
Add another key
A second key unlocks the same files. The files are not rewritten.
Remove a key you no longer have
That key is deleted from this vault. An older copy of the vault still opens with it.