Embed a complete encrypted filesystem inside a single file.

CBFS Vault is a cross-platform SDK for self-contained file storage containers, a filesystem inside a file. A Vault holds files, folders, metadata, and encryption state in one container that works on any storage medium: a hard drive, flash storage, a database record, raw memory, or custom hardware.

Vaults support random read and write access per file, per-file and whole-vault encryption, compression, journaling for crash resilience, alternate data streams, custom metadata, and multithreaded operations. Embed one in your app binaries, ship it as a standalone data file, or mount it as a removable drive.

CBFS Vault does this directly. The CBVault API lets you create a Vault, add files and folders to it, apply per-file or whole-vault encryption with built-in cryptographic algorithms, and read or write individual files with random access, no need to extract the whole archive for one file.

A Vault is a single file on disk, easy to store, move, back up, or embed in your app package. Available in .NET, C++, Java, Python, Rust, Go, Delphi, Qt, Android, iOS, and macOS.

ZIP files need decompression to access or change content, and don't support random writes, versioning, journaling, per-file encryption, or process-level access control. CBFS Vault supports all of that. You can read or write one file in a Vault without touching the others. Journaling protects against corruption if a write gets interrupted. Per-file encryption means different files in the same Vault can use different keys or settings.

CBFS Vault also supports alternate data streams, custom metadata attributes, compound document formats, and multithreaded concurrent access, a full embedded filesystem, not just a compression archive.

CBFS Vault journals every change before committing it. File writes, directory renames, metadata updates all get logged internally first. If a crash or power failure interrupts the operation, CBFS Vault uses the journal to restore a consistent state on next access.

The latest release added new journaling options for tuning the balance between write performance and recovery granularity.

Both per-file and whole-vault encryption. Per-file encryption lets individual files in the same container use different keys or algorithms. Whole-vault encryption applies one encryption layer across the entire container.

Modern cryptographic algorithms are built in. Extension points let you plug in your own encryption implementation if you need to integrate with existing key management or meet specific compliance requirements.

CBFS Vault manages its own internal structure of files, folders, metadata, and encryption inside a single container, entirely in user space, independent of the OS filesystem. Runs on Windows, Linux, macOS, Android, and iOS.

CBFS Disk creates virtual block-level disk drives that the OS sees as raw storage, then formats a standard filesystem like NTFS or FAT on top. It needs a kernel driver on Windows and is Windows-only. Use CBFS Vault for application-level file containers, embedded formats, and cross-platform work. Use CBFS Disk for whole-disk virtualization or when you need the OS managing the filesystem on top of your storage.

Yes. The CBVaultDrive component mounts a Vault as a removable virtual drive, giving users and other apps standard file system access via a drive letter. Good for end-user-facing scenarios where a drive-like interface makes sense alongside the programmatic CBVault API.