A developer who previously created a simple password manager using Electron, React and a symmetric cipher from npm has now rebuilt the application in Tauri and Rust, adding a robust implementation of plausible deniability.
The original design deliberately avoided any “wrong password” screen: any password either opened an existing vault or created a new empty one. This behavior was intended to provide plausible deniability similar to VeraCrypt hidden volumes, but on ordinary files stored in a folder.
Why the first version failed
The initial implementation stored each vault under a filename that was a bcrypt hash of the master password. This created an oracle: an attacker could simply hash a wordlist and match filenames. Additional folders named history/ and sync/ further revealed which vaults were actively used.
Current design
The updated format uses Argon2id (64 MiB memory, t=3, p=1) with one installation-wide salt to derive the key. Each file begins with a 24-byte nonce followed by XChaCha20-Poly1305 ciphertext. No version numbers, headers or magic bytes are present; all metadata resides inside the authenticated ciphertext.
File names are 32 random hexadecimal characters. Vaults are padded to the next power-of-two size bucket (4 KiB, 8 KiB, 16 KiB, …) so that small and large vaults appear identical on disk.
- At first launch the application automatically creates two decoy files filled with random bytes.
- After every write operation, creation, modification and access timestamps of all files in the folder are synchronized.
- History and synchronization records are stored as additional encrypted files containing a “kind” field inside the ciphertext.
The developer notes that the scheme protects against a single snapshot of the disk but remains vulnerable to multiple snapshots taken over time, NTFS USN journals, Windows shadow copies or Time Machine backups.
