SecDocKeeper

Keep your most sensitive documents secure, local, and strictly in your hands. SecDockKeeper is a local-first, end-to-end encrypted vault designed for the files you cannot afford to lose or leak. Whether it's your passport, medical records, tax forms, or confidential contracts, SecDockKeeper ensures your data stays firmly on your device. There are no accounts to create, no cloud servers to trust, and absolutely zero telemetry. IMPORTANT: Your vault is secured by a master password known only to you. If you lose your password, no one—not even us—can recover your data. CORE FEATURES Military-Grade Encryption: Your master password derives a 256-bit key on the device using Argon2id. Every single document gets its own AES-256-GCM data key (envelope encryption). Smart On-Device OCR: Automatically scan and tag imported images (like passports, IDs, and invoices). All text recognition happens entirely locally, meaning your data never leaves your phone. Total Organization: Group your documents into folders, apply color-coded tags, and filter with a single tap. All metadata, names, tags, and full-text search indexes are secured inside a locked SQLCipher database. Hidden "Stealth" Tags: Need plausible deniability? Create hidden tags that are stored only as HMAC hashes. They are entirely invisible in lists and autocomplete, revealing their linked documents only when you type the exact tag name into the search bar. Secure Split-Sharing: Safely share individual documents. Export a file as an encrypted .sdkblob and a separate .sdkkey.json. Send the file over one channel and the key over another for maximum security. Portable Offline Backups: Export your entire vault as a single, fully encrypted archive (blobs and database only, no key material). Easily restore it on a new device using your original master password. Biometric Convenience: Quickly unlock your vault using Face ID or Touch ID. Your master password remains safely sealed in your device’s platform keychain. Anti-Snoop Defaults: The app immediately auto-locks when sent to the background. Decrypted plaintext is strictly short-lived, and temporary viewing directories are automatically wiped every time the vault locks. ABSOLUTE PRIVACY We believe privacy is a default, not a feature. SecDockKeeper contains absolutely zero analytics and no third-party SDKs in the hot path. There are no network calls for document handling. The only journey your files take is from your device's file picker directly into your encrypted, on-device vault. OPEN SOURCE & AUDITABLE Trust requires transparency. SecDockKeeper is 100% open source under the Apache 2.0 license. Our cryptography, database schema, and import paths are fully auditable by anyone.