File Lockbox
Encrypt files with a password or unlock an existing RunTangent container.
Some things are yours to keep.
Choose what you want to keep private.
Choose one file. Its contents and filename go inside the encrypted container.
Browse or drop a fileA separate download carries the result.
A password worth keeping.
Use a long, unique password. Keep it somewhere you can find again.
Local estimate. No online breach lookup.
No reset link. No recovery key.
You’ll need this password to unlock the file.
New files use TGT2 and a random download name. Keep a current reader with your backups; older readers cannot open TGT2. Unlocking restores the original filename.
Keep the file.
Keep the key.
Make an encrypted copy of a document, photograph or archive. Your password opens that copy again. Check the result, keep a backup, and remember that a strong password and a trusted device matter.
New TGT2 format specification · Earlier TGT1 format · Reader for both versions
How to use your lockbox
- Choose your task.Lock creates an encrypted copy. Unlock opens a TGT1 or TGT2 .tangent container.
- Bring one file.Choose or drop a file. Create a ZIP beforehand if you want to include several.
- Keep your password.Enter and confirm it when locking. Use the same password when unlocking.
- Check your copy.Save the download and try unlocking it. Your original file is not removed or changed.
How is the file encrypted?
New TGT2 containers use Web Crypto AES-GCM with a 256-bit key, a fresh 16-byte random salt and a 12-byte random IV. PBKDF2-SHA-256 derives the key using 600,000 iterations, and the container header is authenticated. Earlier TGT1 files still unlock using their original 100,000-iteration format. Older versions of the tool cannot open new TGT2 files. The original filename and type are included inside the encrypted contents. The encrypted download uses a random lockbox name; its size remains visible.
What happens if I forget the password?
There is no password recovery or reset for an encrypted container. RunTangent does not save your password. Keep a reliable record separately. A short PIN or weak password can be guessed; use a long, unique password. The local strength estimate is guidance, not a guarantee; no online breach lookup runs here.
Does locking replace my original file?
No. Locking prepares a separate .tangent download. Your original stays where it was. Unlock and check the downloaded container before making your own decisions about retaining originals. This tool does not erase files or securely wipe your device.
Which files and sizes can I use?
Choose one file at a time, or create a ZIP first to include several files. The whole file is processed in browser memory, so practical size depends on the device and browser. Use smaller files if processing fails. Unlock accepts this tool’s TGT1 and TGT2 .tangent containers. Stronger derivation for new files may take a little longer on your device.
Where does processing happen?
Encryption and decryption run in your browser using Web Crypto; this tool does not upload your file. Use HTTPS or localhost in a browser with Web Crypto support. Access to the page and its dependencies is needed; offline availability is not guaranteed. A compromised device can expose files and passwords.