Vollcrypt is an open-source cryptography workspace for post-quantum messaging, encrypted files, WebAssembly applications, desktop users, and database security integrations. Its security-sensitive cores are written in Rust and exposed through native Node.js and WebAssembly bindings.

Start Here

Quick Install

# File encryption for Node.js
npm install @vollcrypt/files-node

# End-to-end encrypted messaging for Node.js
npm install @vollcrypt/messages-node

All six npm packages are dual-licensed under GPLv3 or a commercial license and published through npm trusted publishing with provenance attestations. Package-specific examples and API notes are linked in the module documentation below.

Join the Project

Vollcrypt welcomes users and contributors. You do not need a cryptography background to help with documentation, examples, cross-platform testing, TypeScript types, or developer tooling.

• Browse good first issues.
• Ask questions or share integration feedback in GitHub Discussions.
• Read the contribution guide before opening a pull request.
• Report security vulnerabilities privately using the security policy.

Documentation Modules

Explore the specific modules of Vollcrypt:

• Vollcrypt Messages Module Documentation (README-messages.md) - Stable, E2EE messaging session managers, PCS ratchets, sealed sender, and transparency logs.
• Vollcrypt Files Module Documentation (README-files.md) - Stable v1.0 file-container encryption with Node.js and WebAssembly bindings.
• Vollcrypt Desktop App Module Documentation (README-desktop.md) - Stable v1.0 native desktop application with cross-platform downloads.
• Vollcrypt DB-Guard Module Documentation (README-db-guard.md) - Database field-level encryption integrations with dynamic KMS routing and optional PKCS#11 providers; not FIPS 140-3 validated.
• Vollcrypt DB-Proxy Module Documentation (README-db-proxy.md) - Zero-trust database protocol proxy (PostgreSQL) executing dynamic envelope decryption and dynamic data masking (DDM) on-the-fly for off-the-shelf BI tools and SQL clients.
• Vollcrypt Scan Documentation (README-scan.md) - Deterministic bounded traversal and explainable, signed criticality classification for integrity monitoring.
• Vollcrypt Wave Module Documentation (README-wave.md) - Standalone, #![no_std] zero-allocation tactical radio COMSEC & TRANSEC protocol with deterministic chaos FHSS, dynamic aliasing, and Doppler sync.
• Vollcrypt Shield Documentation (README-shield.md) - Runtime integrity verification, independent Viewer, bounded scope-only response, and optional commercial fleet operations.

Repository Structure

This repository is organized as a monorepo containing the following modules:

• vollcrypt-messages/: The Rust implementation and bindings for E2EE messaging (Node.js and WebAssembly).
• vollcrypt-files/: The Rust implementation and core logic for E2EE file/stream chunking and verification.
• vollcrypt-wave/: Standalone, #![no_std] zero-allocation tactical radio COMSEC & TRANSEC protocol implementation in Rust.
• vollcrypt-desktop/: Cross-platform desktop application built with Tauri (Rust) and React + Vanilla CSS.
• db-guard/: Database field-level encryption adapters for Node.js and Rust ORMs; not FIPS 140-3 validated.
• db-proxy/: A database wire-protocol proxy for transparent field decryption and masking in-transit.
• vollcrypt-scan/: Product-neutral bounded scanning core and independently reviewed Shield classification rules.
• vollcrypt-shield/: Independent integrity proof core, Linux-first filesystem agent, CLI, and Node native binding.

graph TD
    classDef rust fill:#df5c3f,stroke:#333,stroke-width:1px,color:#fff;
    classDef bindings fill:#f0db4f,stroke:#333,stroke-width:1px,color:#333;
    classDef runtime fill:#43853d,stroke:#333,stroke-width:1px,color:#fff;
    classDef hardware fill:#00a3a6,stroke:#333,stroke-width:1px,color:#fff;

    subgraph Core ["Vollcrypt Core Workspace"]
        vollcrypt_core["vollcrypt-files-core (Rust)"]:::rust
        vollcrypt_messages_core["vollcrypt-core (Rust)"]:::rust
        vollcrypt_wave["vollcrypt-wave (Rust - no_std)"]:::rust
    end

    subgraph Bindings ["Binding Adapters"]
        napi["vollcrypt-messages/node (napi-rs)"]:::bindings
        wasm["vollcrypt-messages/wasm (wasm-bindgen)"]:::bindings
        files_node["vollcrypt-files/node (Node streams)"]:::bindings
        files_wasm["vollcrypt-files/wasm (Browser streams)"]:::bindings
    end

    subgraph Clients ["Application Runtimes"]
        node_app["Node.js Backend / Server (e.g. NestJS)"]:::runtime
        web_app["Web Browser / Front-end (e.g. Next.js)"]:::runtime
        native_app["Native Rust Applications / Daemons"]:::rust
        desktop_app["Vollcrypt Desktop App (Tauri v2 + React)"]:::runtime
        embedded_app["Tactical SDR / Bare-metal Hardware"]:::hardware
    end

    vollcrypt_messages_core --> napi
    vollcrypt_messages_core --> wasm
    vollcrypt_core --> files_node
    vollcrypt_core --> files_wasm
    vollcrypt_core --> desktop_app

    napi --> node_app
    wasm --> web_app
    files_node --> node_app
    files_wasm --> web_app
    vollcrypt_messages_core --> native_app
    
    vollcrypt_wave --> embedded_app
    vollcrypt_wave --> native_app

Core Capabilities & Cryptographic Guarantees

Vollcrypt workspace exposes a unified suite of quantum-resistant cryptographic engines, application-level clients, and transparent database security proxies:

1. Quantum-Resistant End-to-End Encryption (E2EE) Secures messaging sessions and file distribution pipelines against both current and future quantum computing threats.
   • Hybrid Key Encapsulation: Combines FIPS 203 ML-KEM-768 with classical X25519 ECDH.
   • PCS & Forward Secrecy: Continuous ephemeral key ratcheting isolates key compromise and secures historical archives.
   • Sender & Receiver Privacy: Zero-knowledge Sealed Sender routing hides message metadata from delivery servers, and Blind Cluster Multicast hides recipient destinations.
2. Transparent Database & Zero-Trust Security Protects sensitive database records directly at-rest and in-transit without modifications to off-the-shelf software.
   • Field-Level Encryption (DB-Guard): Modular ORM adapters (Drizzle, Mongoose, SeaORM, etc.) with dynamic KMS routing.
   • Zero-Trust Wire Proxy (DB-Proxy): Transparently decrypts and masks PostgreSQL fields on-the-fly for business intelligence tools and SQL clients.
3. High-Performance Desktop Cryptography Provides a cross-platform, native desktop application (Tauri v2 + React) designed to encrypt local files and text.
   • Stream Chunking & Verification: Encrypts large files in chunks and validates integrity using Merkle trees without fully downloading the file.
4. Tactical & Covert Radio TRANSEC/COMSEC (Vollcrypt Wave) A #![no_std] bare-metal compatible library designed to secure digital and software-defined radios (SDR) under extreme noise and jamming environments.
   • Chaotic Frequency Hopping (FHSS): Non-linear dynamical chaos systems (Logistic Map / Lorenz Attractors) generate hopping sequences indistinguishable from background noise.
   • Anti-Jamming & Acoustic Fallback: Dynamically escapes jamming frequencies via emergency hopping or autonomous ultrasonic fallback.
   • Hardware Abstraction Layer (HAL): Decouples radio front-end drivers (Aselsan, Harris, SDR) from the cryptography engine.
5. Anti-Tamper & Sovereign Control Establishes physical and logical guardrails for hardware devices.
   • Poison Pill Zeroization: Wipes key material and permanently locks compromised devices via Ed25519-signed OTAZ commands.
   • Reactive Hardware Wiping: Triggered automatically upon case intrusion or debugger JTAG connection detection.
6. Runtime Integrity and Scoped Containment (Vollcrypt Shield) Verifies filesystem, OCI image, SQLite record, and embedded-device state against ML-DSA-65 signed Merkle roots and records signed, tamper-evident audit events.
   • Bounded Response: Mandatory dry-run precedes reversible quarantine, atomic rollback, and scope-only containment on supported Linux/Unix targets.
   • Embedded Foundation: A standalone, zero-allocation #![no_std] integrity state supports Cortex-M33, Cortex-M4, and RV32 hardware integrations without depending on Wave.
   • No Global Device Lock: Shield does not shut down the operating system, cut networking, or globally stop unrelated scopes.

Building From Source

Prerequisites

You must have Rust, Node.js, and compiler tools set up on your machine. Depending on your Operating System, additional libraries are required:

Compilation Steps

# Clone the repository
git clone https://github.com/BeratVural/vollcrypt.git
cd vollcrypt

# 1. Run all workspace Rust tests
cargo test --workspace

# 2. Format and Lint checks
cargo fmt --all -- --check
cargo clippy --workspace -- -D warnings

# 3. Build Node.js Native Addon for Messages
cd vollcrypt-messages/node
npm install
npm run build
cd ../..

# 4. Build WebAssembly target for Messages
cd vollcrypt-messages/wasm
wasm-pack build --target web --out-dir pkg
cd ../..

# 5. Build and Run Vollcrypt Desktop Application
cd vollcrypt-desktop
npm install
npm run tauri dev      # Launches developer dev server
npm run tauri build    # Packages optimized production installer (.msi/.exe)
cd ..

Troubleshooting Common Build Issues

• Error: ClangNotFound or could not find libclang
  • Cause: The Rust package generator cannot locate Clang for parsing headers.
  • Resolution:
    • Windows: Install LLVM via winget: winget install LLVM.LLVM or chocolatey: choco install llvm. Then add a system environment variable LIBCLANG_PATH pointing to the directory containing libclang.dll (typically C:\Program Files\LLVM\bin).
    • macOS: Install Xcode Command Line Tools. Clang is bundled.
    • Linux: Install clang and development headers: sudo apt-get install clang libclang-dev (Ubuntu/Debian) or sudo dnf install clang clang-devel (Fedora).
• Error: wasm-pack target directory locked
  • Cause: Concurrent builds or crashed builds holding the compiler lock file.
  • Resolution: Run cargo clean in the root workspace folder to clear target lock files, then rerun the wasm-pack command.
• Error: MSB4019: The imported project ... was not found
  • Cause: Visual Studio build tools are missing or not properly configured for Node native module generation on Windows.
  • Resolution: Run a powershell instance as administrator and install desktop build tools: npm install --global --production windows-build-tools or install manually via Visual Studio Installer.

Licensing

Vollcrypt is dual-licensed under:

• Open Source: GNU General Public License v3.0 (LICENSE-GPL)
• Commercial: Vollcrypt Commercial License (LICENSE-COMMERCIAL.md)

For commercial license purchases, pricing, or custom enterprise terms, please contact berat.vural.tr@gmail.com.