VaultStream is an ultra-secure, privacy-hardened, cross-platform local-first vault application built with Flutter. It combines seamless cloud/local synchronization with military-grade local encryption, proactive anti-leakage guards, a fully functional decoy scientific calculator interface, and recovery capabilities.
- Decoy Calculator: Disguise your entry screen as a fully functioning Scientific Calculator. Entering your custom stealth PIN instantly unlocks your actual vault files.
- Dynamic Privacy: When locked in stealth decoy mode, system-level screenshot guards are lifted so the calculator functions like any normal utility app.
- Background Invalidation: WidgetsBinding observers listen to the platform lifecycle. The moment the app transitions to the background (
paused,hidden, or minimized), your session is destroyed instantly. - Biometric Gatekeeping: On relaunch, access is guarded behind biometric authentication (fingerprint/face unlock) or standard PIN/password check.
- Session Timeout: Custom inactivity lockouts (e.g., locking after 1, 3, 5, or 10 minutes of idleness).
- Dynamic Capture Block: Screenshots and screen recordings are strictly blocked via native platform layers (
FLAG_SECUREon Android) only when the vault is unlocked. - App Switcher Blur Masking: Automatically applies an active blur overlay in multitasking drawers on iOS/Android to prevent shoulder surfing or thumbnail caching.
- Intruder Photo Capture: Automatically triggers the front camera to capture a photo of anyone trying to unlock the vault with an incorrect PIN.
- Custom Thresholds: Configure the failed attempts threshold (1, 3, 5, or 10 attempts) in settings before a capture is initiated.
- Zero-Knowledge Logs: Captured images are encrypted with AES-GCM and stored securely in local app storage. Viewing/clearing them requires entering your vault PIN twice for verification.
- Emergency Invalidation: Set up a secondary "Emergency Wipe PIN".
- Instant Wipe Queue: Entering the panic PIN on the calculator entry screen instantly purges all local keys, decrypted files, credentials, local databases, and logs out the user immediately to prevent physical coercion data access.
- Countdown Delay: Configure a customizable countdown delay (e.g. 5, 10, or 30 seconds) with visual cues before executing the purge.
- Soft Deletions: Trashing a file doesn't destroy it immediately. It marks it as
isDeletedwith adeletedAttimestamp, cataloged in the local audit trail. - Bin Management: Retrieve deleted assets easily via the settings panel. Restore them with original metadata intact, or execute a permanent purge with PIN confirmation.
- Schema Safety: Uses custom Drift migrations (Schema Version 2) to upgrade existing database instances on devices seamlessly.
- Recursive Zipping: Drag or select entire directories from your device. VaultStream compresses them recursively in secure background isolates queue.
- Deep Archive Strategy: Enable deep archive mode in settings to apply maximum compression algorithms for large files, saving storage space at the cost of processing time.
- WiFi-Only Sync: Optional toggle to restrict vault sync uploads to active Wi-Fi connections, conserving mobile bandwidth.
- Gallery Album Watching: Select and watch specific device photo/video albums/folders (utilizing native
photo_managerpermission layers). - Auto-Sync: Monitor changes in watched folders and sync new local media into the encrypted vault automatically.
- E2EE Ephemeral Relay: Securely transfer files to other users using zero-knowledge end-to-end encryption routed through a secure ephemeral relay and protected by pairing codes.
- Quick Share Dashboard: A dedicated quick-access card on the home dashboard enables you to select local files, automatically compress and encrypt them, and generate pairing codes instantly.
- Focus Preservation: Integrates seamlessly with
systemPickerActiveProviderto bypass session auto-locks when picking files via the device's system file manager. - List / Grid Preview Toggle: Preview selected vault or local files on the Share screen with an interactive toggle to switch between structured list tiles and preview grid cards.
- Shares History Tabs: The expanded History screen features a nested sub-tab structure (Sent & Received) tracking all completed, failed, or pending transfer logs.
- Local Logs: Automatically generates detailed, immutable local audit trails of all critical activities (uploads, downloads, restores, deletes, settings changes, sync events).
- History View: Clear or inspect recent logs directly in the app after verifying your vault PIN.
- Core: Flutter (Dart)
- State Management: Riverpod
- Local Database: Drift (SQLite wrapper) with reactive streams
- Cryptography: Cryptography package (Argon2id, AES-GCM)
- Authentication: Firebase Auth, Local Auth (Biometrics)
- Compression: Archive package (Zip formats)
- Local Privacy APIs: Screen Protector native bindings
- File & OS Sharing: Share Plus & File Picker
- Decoy Calculator: Math Expressions
Make sure you have Flutter SDK installed on your machine.
- Clone the repository:
git clone https://github.com/RKushari/VaultStream.git cd VaultStream - Fetch dependencies:
flutter pub get
- Run the generator to build Drift database schema and Riverpod providers:
dart run build_runner build --delete-conflicting-outputs
- Run the application:
flutter run
Ensure the codebase adheres to strict quality guidelines and is free of warnings:
dart analyzeIf you are hosting this repository on GitHub, here are the recommended details for your project page:
🔒 Ultra-secure, privacy-hardened local-first vault application in Flutter featuring decoy stealth interfaces, dynamic screenshot-blocking, app-lifecycle session invalidation, recoverable soft-deletes, and directory compression.
flutter privacy encryption vault security sqlite riverpod drift decoy stealth-mode local-first zero-knowledge mobile-security security-hardening file-encryption firebase p2p-file-sharing biometrics argon2