Features & How It Works
Understand the architecture, explore every feature, and see why Necron is different from other encrypted storage tools.
The Core Concept
You see your real filenames and folder structure.
Storage providers see only encrypted blobs with random names.
A vault is your private file library inside Necron. You work with a normal-looking file tree, while storage providers only see encrypted data.
The Data Flow
Select files or folders from your computer. They stay on your device as plaintext until encryption completes.
Using key material from your USB key drive, a unique 256-bit encryption key is derived per file via HKDF. No two files share the same key.
Each file is encrypted and authenticated locally. Filenames and folder structure are also sealed — storage providers see only random-looking names.
The encrypted objects are placed in the storage folders you chose — local folders, external drives, or cloud-synced folders. Multiple locations get identical copies.
Necron compares mirrors to detect missing, damaged, or out-of-date copies. If one location has a problem, it can be repaired from a healthy mirror.
Security Boundaries
For a complete technical analysis, read the security whitepaper or download the PDF.
All Features
Keep one vault mirrored across multiple storage providers at once. Necron stores and syncs encrypted vault data only — the app presents a usable “view” when you access your files.
If a location goes missing or falls behind, the vault can reconcile and restore from healthy mirrors. Redundancy isn’t just backup — it’s built into the system’s normal operation.
Create separate vaults for different projects, clients, or risk profiles. Each vault can have its own mirrored locations — mix local + cloud providers however you want.
Your encryption keys are stored on a dedicated USB key drive, not on your computer or in the cloud. Keep backup drives to protect against loss — without copying keys onto a device.
Every file gets its own unique 256-bit encryption key derived from your key drive material. Compromise of one file’s key doesn’t cascade to other files.
Built on widely vetted cryptography: XChaCha20-Poly1305 for authenticated encryption, HMAC-SHA-256 for integrity checks, and HKDF for key derivation. 256-bit symmetric cryptography is widely considered quantum-resilient for practical threat models.
Encrypted data is chunked and hashed, making tampering detectable and reducing useful patterns for an attacker. It’s not just encryption — it’s structured to be hard to analyze and hard to alter silently.
Add a vault-level second factor so access requires something you have (USB key drive) plus a second verification step (PIN + TOTP). This reduces risk from stolen drives or unattended machines.
Go Deeper
Start with a free account. Upgrade to Pro for USB key drive security when you’re ready.
