{"slug": "show-hn-revault-new-secure-archive-format", "title": "Show HN: ReVault – new secure archive format", "summary": "A developer released reVault, a beta secure archive format called a \"lockbox\" that encrypts, signs and compresses content by default, after roughly 2 years of work that included porting the tool from Dart to Rust with AI assistance. Each lockbox supports hybrid post-quantum or passphrase encryption including metadata, Zstd compression, and selective disabling of encryption, signing or compression; the core is Rust with bindings for C/C++, Java, Dart, Python, Ruby, JS/TypeScript, Go, C#, Kotlin, Lua, PHP and Swift, running on Linux, macOS and Windows (x64 and arm64) plus Wasm. The developer is seeking feedback on the APIs and language bindings, and said the project was scanned using OpenAI's Daybreak cyber security tools.", "body_md": "reVault is a new, secure-by-default archive format called a lockbox, designed to be simple to use.\n\nI've been working on reVault for about 2 years. It was originally written in Dart, but with the improvements in AI, I decided to port it to Rust using AI.\n\nIt's now in beta, so I'm looking for feedback, particularly around the different language bindings.\n\nA lockbox is encrypted, signed and compressed by default. Each can be disabled selectively.\n\n```\n  - Hybrid post-quantum or passphrase encryption, including metadata.\n  - Zstd compression.\n  - Pure Rust libraries wherever possible.\n```\n\nWe intend to phase out remaining C code as alternatives become available. The project has been scanned using OpenAI's Daybreak cyber security tools.\nThe manual is a work in progress:\n[https://docs.revault.onepub.dev/](https://docs.revault.onepub.dev/)\n\nreVault supports Linux, macOS and Windows, x64 and arm64, plus Wasm. The core is Rust, with bindings for C/C++, Java, Dart, Python, Ruby, JS/TypeScript, Go, C#, Kotlin, Lua, PHP and Swift.\n\nWithin a lockbox you can store:\n\n```\n  - Files, directories, permissions and symlinks.\n  - Variables.\n  - Forms.\n```\n\nVariables, forms and the lockbox itself can have descriptions.\nreVault uses a portable vault (just another lockbox with structured content) to hold your keys, contacts' keys, lockbox aliases and form definitions.\n\nIt ties into your platform's secure store, so logging into your desktop unlocks your vault. You don't have to enter a passphrase every time you access a lockbox. You can disable this.\n\nThere are lots of shortcuts. Creating a lockbox stores an alias in your vault, based on its filename or a name you choose:\n\n```\n  lbx create /some/path/mybox.lbox\n  lbx mybox open --duration 1h\n  lbx mybox var set KEY VALUE\n```\n\nSet a default lockbox and you can leave its name out:\n\n``` js\n  lbx session default mybox\n  lbx var get KEY\n```\n\nYou can mirror a directory tree into a lockbox and update it when the directory changes:\n\n```\n  lbx store.lbox mirrors project create --from ./project --to /projects/project\n  lbx store.lbox mirrors update\n```\n\nThe API lets you read, write and seek within files without extracting them to the filesystem. Each lockbox has a table of contents, so extracting a single file from a multi-gigabyte lockbox is fast.\nRecovery\n\nUpdates are transactional, with automatic rollback for failed updates. The format is designed for recovery: content is stored in pages, allowing unaffected content to be recovered if part of a lockbox is corrupted.\n\nSharing\n\nAn encrypted lockbox is more useful if you can share it.\n\nreVault has an open-source keyserver for exchanging public keys, with validation through a second trusted channel. It's still experimental.\n\nOnePub has donated a server to run a single keyserver. If you're interested in donating resources, I'd like to bring up a second redundant server. It's pure Rust, uses under 100 MB RSS and supports rate limits.\n\nTo publish your default profile's public key:\n\n```\n  lbx vault profiles email you@example.com\n  lbx vault profiles publish\n```\n\nGive the publish code to your contact. They can import your key:\n\n```\n  lbx vault contacts receive\n```\n\nDisplay your profile's fingerprint and exchange it through a second trusted channel:\n\n```\n  lbx vault profiles fingerprint\n```\n\nRepeat the process in the opposite direction to get their key. Once you have it, grant them access to your default lockbox:\n\n```\n  lbx access grant alice\n```\n\nYou can then email the encrypted lockbox to Alice.\nTo install the CLI and get started:\n\n```\n  cargo install revault_cli\n  lbx vault init\n  lbx completion install\n```\n\nCompletion installation detects your shell. To diagnose issues:\n\n```\n  lbx doctor\n```\n\nThe language bindings are published to their respective package repositories.\nI'm looking for constructive criticism of the project on its own merits, particularly the APIs and language bindings. I'm not interested in a debate about using AI.\n\nComments URL: [https://news.ycombinator.com/item?id=50227527](https://news.ycombinator.com/item?id=50227527)\n\nPoints: 6\n\n# Comments: 2", "url": "https://wpnews.pro/news/show-hn-revault-new-secure-archive-format", "canonical_source": "https://news.ycombinator.com/item?id=50227527", "published_at": "2026-10-25 02:01:21+00:00", "updated_at": "2026-10-25 18:41:34.838653+00:00", "lang": "en", "topics": ["developer-tools"], "entities": ["reVault", "Rust", "Dart", "OpenAI", "OnePub", "Wasm", "Zstd"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-revault-new-secure-archive-format", "markdown": "https://wpnews.pro/news/show-hn-revault-new-secure-archive-format.md", "text": "https://wpnews.pro/news/show-hn-revault-new-secure-archive-format.txt", "jsonld": "https://wpnews.pro/news/show-hn-revault-new-secure-archive-format.jsonld"}}